Cyberoam Console Guide

70
Console Guide Version 9 Document version 96-2.0-16/07/2009

Transcript of Cyberoam Console Guide

Page 1: Cyberoam Console Guide

Console Guide Version 9

Document version 96-20-16072009

IMPORTANT NOTICE Elitecore has supplied this Information believing it to be accurate and reliable at the time of printing but is presented without warranty of any kind expressed or implied Users must take full responsibility for their application of any products Elitecore assumes no responsibility for any errors that may appear in this document Elitecore reserves the right without notice to make changes in product design or specifications Information is subject to change without notice

USERrsquoS LICENSE

The Appliance described in this document is furnished under the terms of Elitecorersquos End User license agreement Please read these terms and conditions carefully before using the Appliance By using this Appliance you agree to be bound by the terms and conditions of this license If you do not agree with the terms of this license promptly return the unused Appliance and manual (with proof of payment) to the place of purchase for a full refund

LIMITED WARRANTY

Software Elitecore warrants for a period of ninety (90) days from the date of shipment from Elitecore (1) the media on which the Software is furnished will be free of defects in materials and workmanship under normal use and (2) the Software substantially conforms to its published specifications except for the foregoing the software is provided AS IS This limited warranty extends only to the customer as the original licenses Customers exclusive remedy and the entire liability of Elitecore and its suppliers under this warranty will be at Elitecore or its service centerrsquos option repair replacement or refund of the software if reported (or upon request returned) to the party supplying the software to the customer In no event does Elitecore warrant that the Software is error free or that the customer will be able to operate the software without problems or interruptions Elitecore hereby declares that the anti virus and anti spam modules are powered by Kaspersky Labs and by Commtouch respectively and the performance thereof is under warranty provided by Kaspersky Labs and by Commtouch It is specified that Kaspersky Lab does not warrant that the Software identifies all known viruses nor that the Software will not occasionally erroneously report a virus in a title not infected by that virus Hardware Elitecore warrants that the Hardware portion of the Elitecore Products excluding power supplies fans and electrical components will be free from material defects in workmanship and materials for a period of One (1) year Elitecores sole obligation shall be to repair or replace the defective Hardware at no charge to the original owner The replacement Hardware need not be new or of an identical make model or part Elitecore may in its discretion replace the defective Hardware (or any part thereof) with any reconditioned product that Elitecore reasonably determines is substantially equivalent (or superior) in all material respects to the defective Hardware

DISCLAIMER OF WARRANTY

Except as specified in this warranty all expressed or implied conditions representations and warranties including without limitation any implied warranty or merchantability fitness for a particular purpose non-infringement or arising from a course of dealing usage or trade practice and hereby excluded to the extent allowed by applicable law In no event will Elitecore or its supplier be liable for any lost revenue profit or data or for special indirect consequential incidental or punitive damages however caused and regardless of the theory of liability arising out of the use of or inability to use the product even if Elitecore or its suppliers have been advised of the possibility of such damages In the event shall Elitecorersquos or its supplierrsquos liability to the customer whether in contract tort (including negligence) or otherwise exceed the price paid by the customer The foregoing limitations shall apply even if the above stated warranty fails of its essential purpose In no event shall Elitecore or its supplier be liable for any indirect special consequential or incidental damages including without limitation lost profits or loss or damage to data arising out of the use or inability to use this manual even if Elitecore or its suppliers have been advised of the possibility of such damages

RESTRICTED RIGHTS

Copyright 1999-2009 Elitecore Technologies Ltd All rights reserved Cyberoam Cyberoam logo are trademark of Elitecore Technologies Ltd

CORPORATE HEADQUARTERS

Elitecore Technologies Ltd 904 Silicon Tower Off CG Road Ahmedabad ndash 380015 INDIA Phone +91-79-66065606 Fax +91-79-26407640 Web site wwwelitecorecom wwwcyberoamcom

Cyberoam Console Guide

1

Contents

Preface 1 Guide Audience 1 Technical Support 2 Typographic Conventions 3

Introduction 4 Accessing Cyberoam CLI Console 4

Accessing CLI Console via remote login utility - TELNET 4 Accessing CLI Console using SSH client 4

R Restart Management Services 6 1 Network configuration 7

For Gateway mode 7 For Transparent (bridge) mode 8

11 IP address configuration 9 12 Add Alias 9 13 Remove Alias 10 14 Remove All Alias 10 15 VLAN Management 11 151 Add VLAN ID 11 152 Remove VLAN ID 12 153 Show VLAN ID Configuration 13 150 Exit 13

10 Exit 13 2 System configuration 14

21 Set Console Password 14 22 Set System Date 14 23 View Access logs 15 24 Set Cyberoam Administrator Email ID 16 25 Traceroute Utility 17 26 Set Module Info 17 27 Bandwidth Graph Setting 17

271 Flush Gateway Graphs 18 272 Flush System Health Graphs 18 273 Flush All Bandwidth Graphs 18 270 Exit 18

28 EnableDisable LAN Bypass 18 20 Exit 18

3 Route configuration 19 31 Configure Unicast Routing 19

311 Configure Static-routesACLs 19 312 Configure RIP 21 313 Configure OSPF 23 313 Configure Border Gateway Protocol (BGP) 25 310 Exit 26

32 Configure Multicast Routing 27 321 EnableDisable Multicast forwarding 28 322 Configure Static multicast routes 29 320 Exit 30

30 Exit 30 4 Cyberoam Console 31 5 Cyberoam Management 32

51 Restart Management Services 32 52 Remove Firewall Rules 32 53 Reset Management Password 33

Cyberoam Console Guide

2

54 Database Utilities 33 541 Database Quick Repair 33 542 Database Full Repair 34 543 Repair Web Surfing logs 34 544 Repair User Session logs 34 545 Repair Live User Data 34 546 Synchronize Live User Data 34 547 Repair Summary table Data 34 540 Exit 34

55 Download Backup 35 56 Restore Backup 35 57 DHCP Client Settings 35 58 View Audit Logs 36 59 Check and Upgrade New version 36 510 Auto Upgrade status 36 511 Check and Update Webcat Latest Database 36 512 Webcat Auto Upgrade Status 37 513 Reset to Factory Defaults 37 514 Custom Menu 37 515 HA Configuration 37

5151 Disable HA 37 5152 Reset HA 38 5153 Show details 38 5150 Exit 38

516 Rollback to previous version 38 517 ReBuild New Firewall State 39 50 Exit 39

6 Upgrade version 40 7 Bandwidth Monitor 40 8 VPN Management 41

81 Regenerate RSA Key 41 82 Restart VPN service 42 83 View VPN Logs 42 83 View Connection wise VPN Logs 42 84 View Connection wise VPN Logs 42 85 Advance VPN Logs 43 86 PPTP VPN Logs 43 80 Exit 43

9 ShutdownReboot Cyberoam 44 0 Exit 44 Annexure A 45

Change Log 65

Cyberoam Console Guide

3

Annexure I - Contents

arp 45

clear 45

cyberoam45

disableremote46

dnslookup 46

enableremote 47

httpclient 47

ip 47

message52

packet-capture 52

ping 53

route54

set 55

show 59

tcpdump 61

telnet 63

traceroute64

Cyberoam Console Guide

1

Preface Welcome to Cyberoamrsquos ndash Console guide Cyberoam is an Identity-based UTM Appliance Cyberoamrsquos solution is purpose-built to meet the security needs of corporate government organizations and educational institutions Cyberoamrsquos perfect blend of best-of-breed solutions includes user based Firewall Content filtering Anti Virus Anti Spam Intrusion Prevention System (IPS) and VPN Cyberoam provides increased LAN security by providing separate port for connecting to the publicly accessible servers like Web server Mail server FTP server etc hosted in DMZ which are visible the external world and still have firewall protection Cyberoam Console guide helps you administer monitor and manage Cyberoam with the help of Console Note that by default Cyberoam Console password is lsquoadminrsquo It is recommended to change the default password immediately after Installation

Guide Audience

Cyberoam Console Guide provides functional and technical information of the Cyberoam Software This Guide is written to serve as a technical reference and describes features that are specific to the Console Guide also provides the brief summary on using the Console commands This guide is intended for the Network Administrators and Support personnel who perform the following tasks bull Configure System amp Network bull Manage and maintain Network bull Manage various services bull Troubleshooting This guide is intended for reference purpose and readers are expected to possess basic-to-advanced knowledge of systems networking

Note The Corporate and individual names data and images in this guide are for demonstration purposes only and does not reflect the real data

If you are new to Cyberoam use this guide along with the lsquoCyberoam User Guidersquo

Cyberoam Console Guide

2

Technical Support

You may direct all questions comments or requests concerning the software you purchased your registration status or similar issues to Customer careservice department at the following address Corporate Office eLitecore Technologies Ltd 904 Silicon Tower Off CG Road Ahmedabad 380015 Gujarat India Phone +91-79-66065606 Fax +91-79-26407640 Web site wwwelitecorecom Cyberoam contact Technical support (Corporate Office) +91-79- 26400707 Email supportcyberoamcom Web site wwwcyberoamcom Visit wwwcyberoamcom for the regional and latest contact information

Cyberoam Console Guide

3

Typographic Conventions

Material in this manual is presented in text screen displays or command-line notation

Item Convention Example

Server Machine where Cyberoam Software - Server component is installed

Client Machine where Cyberoam Software - Client component is installed

User The end user Username Username uniquely identifies the user of the system Topic titles Shaded font

typefaces Introduction

Subtitles Bold and Black typefaces

Notation conventions

Navigation link

Bold typeface

Group Management rarr Groups rarr Create it means to open the required page click on Group management then on Groups and finally click Create tab

Notes amp points to remember

Bold typeface between the black borders

Note

Cyberoam Console Guide

4

Introduction Cyberoam CLI console provides a collection of tools to administer monitor and control certain Cyberoam components

Accessing Cyberoam CLI Console Two ways to access Cyberoam CLI console 1 Direct Console connection - attaching a keyboard and monitor directly to the Cyberoam 2 Remote connection a) Using remote login utility ndash TELNET b) Using SSH client

Accessing CLI Console via remote login utility - TELNET

To use TELNET IP Address of the Cyberoam is required Use command ldquotelnet ltCyberoam IP addressgtrdquo to start TELNET utility from command prompt and log on with default password ldquoadminrdquo

Screen - Console login screen

Accessing CLI Console using SSH client

Access Cyberoam CLI console using any of the SSH client Cyberoam IP Address is required Start SSH client and create new Connection with the following parameters Hostname - ltCyberoam IP Addressgt Username ndash admin Password ndash admin On successful login following Main menu screen will be shown

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 2: Cyberoam Console Guide

IMPORTANT NOTICE Elitecore has supplied this Information believing it to be accurate and reliable at the time of printing but is presented without warranty of any kind expressed or implied Users must take full responsibility for their application of any products Elitecore assumes no responsibility for any errors that may appear in this document Elitecore reserves the right without notice to make changes in product design or specifications Information is subject to change without notice

USERrsquoS LICENSE

The Appliance described in this document is furnished under the terms of Elitecorersquos End User license agreement Please read these terms and conditions carefully before using the Appliance By using this Appliance you agree to be bound by the terms and conditions of this license If you do not agree with the terms of this license promptly return the unused Appliance and manual (with proof of payment) to the place of purchase for a full refund

LIMITED WARRANTY

Software Elitecore warrants for a period of ninety (90) days from the date of shipment from Elitecore (1) the media on which the Software is furnished will be free of defects in materials and workmanship under normal use and (2) the Software substantially conforms to its published specifications except for the foregoing the software is provided AS IS This limited warranty extends only to the customer as the original licenses Customers exclusive remedy and the entire liability of Elitecore and its suppliers under this warranty will be at Elitecore or its service centerrsquos option repair replacement or refund of the software if reported (or upon request returned) to the party supplying the software to the customer In no event does Elitecore warrant that the Software is error free or that the customer will be able to operate the software without problems or interruptions Elitecore hereby declares that the anti virus and anti spam modules are powered by Kaspersky Labs and by Commtouch respectively and the performance thereof is under warranty provided by Kaspersky Labs and by Commtouch It is specified that Kaspersky Lab does not warrant that the Software identifies all known viruses nor that the Software will not occasionally erroneously report a virus in a title not infected by that virus Hardware Elitecore warrants that the Hardware portion of the Elitecore Products excluding power supplies fans and electrical components will be free from material defects in workmanship and materials for a period of One (1) year Elitecores sole obligation shall be to repair or replace the defective Hardware at no charge to the original owner The replacement Hardware need not be new or of an identical make model or part Elitecore may in its discretion replace the defective Hardware (or any part thereof) with any reconditioned product that Elitecore reasonably determines is substantially equivalent (or superior) in all material respects to the defective Hardware

DISCLAIMER OF WARRANTY

Except as specified in this warranty all expressed or implied conditions representations and warranties including without limitation any implied warranty or merchantability fitness for a particular purpose non-infringement or arising from a course of dealing usage or trade practice and hereby excluded to the extent allowed by applicable law In no event will Elitecore or its supplier be liable for any lost revenue profit or data or for special indirect consequential incidental or punitive damages however caused and regardless of the theory of liability arising out of the use of or inability to use the product even if Elitecore or its suppliers have been advised of the possibility of such damages In the event shall Elitecorersquos or its supplierrsquos liability to the customer whether in contract tort (including negligence) or otherwise exceed the price paid by the customer The foregoing limitations shall apply even if the above stated warranty fails of its essential purpose In no event shall Elitecore or its supplier be liable for any indirect special consequential or incidental damages including without limitation lost profits or loss or damage to data arising out of the use or inability to use this manual even if Elitecore or its suppliers have been advised of the possibility of such damages

RESTRICTED RIGHTS

Copyright 1999-2009 Elitecore Technologies Ltd All rights reserved Cyberoam Cyberoam logo are trademark of Elitecore Technologies Ltd

CORPORATE HEADQUARTERS

Elitecore Technologies Ltd 904 Silicon Tower Off CG Road Ahmedabad ndash 380015 INDIA Phone +91-79-66065606 Fax +91-79-26407640 Web site wwwelitecorecom wwwcyberoamcom

Cyberoam Console Guide

1

Contents

Preface 1 Guide Audience 1 Technical Support 2 Typographic Conventions 3

Introduction 4 Accessing Cyberoam CLI Console 4

Accessing CLI Console via remote login utility - TELNET 4 Accessing CLI Console using SSH client 4

R Restart Management Services 6 1 Network configuration 7

For Gateway mode 7 For Transparent (bridge) mode 8

11 IP address configuration 9 12 Add Alias 9 13 Remove Alias 10 14 Remove All Alias 10 15 VLAN Management 11 151 Add VLAN ID 11 152 Remove VLAN ID 12 153 Show VLAN ID Configuration 13 150 Exit 13

10 Exit 13 2 System configuration 14

21 Set Console Password 14 22 Set System Date 14 23 View Access logs 15 24 Set Cyberoam Administrator Email ID 16 25 Traceroute Utility 17 26 Set Module Info 17 27 Bandwidth Graph Setting 17

271 Flush Gateway Graphs 18 272 Flush System Health Graphs 18 273 Flush All Bandwidth Graphs 18 270 Exit 18

28 EnableDisable LAN Bypass 18 20 Exit 18

3 Route configuration 19 31 Configure Unicast Routing 19

311 Configure Static-routesACLs 19 312 Configure RIP 21 313 Configure OSPF 23 313 Configure Border Gateway Protocol (BGP) 25 310 Exit 26

32 Configure Multicast Routing 27 321 EnableDisable Multicast forwarding 28 322 Configure Static multicast routes 29 320 Exit 30

30 Exit 30 4 Cyberoam Console 31 5 Cyberoam Management 32

51 Restart Management Services 32 52 Remove Firewall Rules 32 53 Reset Management Password 33

Cyberoam Console Guide

2

54 Database Utilities 33 541 Database Quick Repair 33 542 Database Full Repair 34 543 Repair Web Surfing logs 34 544 Repair User Session logs 34 545 Repair Live User Data 34 546 Synchronize Live User Data 34 547 Repair Summary table Data 34 540 Exit 34

55 Download Backup 35 56 Restore Backup 35 57 DHCP Client Settings 35 58 View Audit Logs 36 59 Check and Upgrade New version 36 510 Auto Upgrade status 36 511 Check and Update Webcat Latest Database 36 512 Webcat Auto Upgrade Status 37 513 Reset to Factory Defaults 37 514 Custom Menu 37 515 HA Configuration 37

5151 Disable HA 37 5152 Reset HA 38 5153 Show details 38 5150 Exit 38

516 Rollback to previous version 38 517 ReBuild New Firewall State 39 50 Exit 39

6 Upgrade version 40 7 Bandwidth Monitor 40 8 VPN Management 41

81 Regenerate RSA Key 41 82 Restart VPN service 42 83 View VPN Logs 42 83 View Connection wise VPN Logs 42 84 View Connection wise VPN Logs 42 85 Advance VPN Logs 43 86 PPTP VPN Logs 43 80 Exit 43

9 ShutdownReboot Cyberoam 44 0 Exit 44 Annexure A 45

Change Log 65

Cyberoam Console Guide

3

Annexure I - Contents

arp 45

clear 45

cyberoam45

disableremote46

dnslookup 46

enableremote 47

httpclient 47

ip 47

message52

packet-capture 52

ping 53

route54

set 55

show 59

tcpdump 61

telnet 63

traceroute64

Cyberoam Console Guide

1

Preface Welcome to Cyberoamrsquos ndash Console guide Cyberoam is an Identity-based UTM Appliance Cyberoamrsquos solution is purpose-built to meet the security needs of corporate government organizations and educational institutions Cyberoamrsquos perfect blend of best-of-breed solutions includes user based Firewall Content filtering Anti Virus Anti Spam Intrusion Prevention System (IPS) and VPN Cyberoam provides increased LAN security by providing separate port for connecting to the publicly accessible servers like Web server Mail server FTP server etc hosted in DMZ which are visible the external world and still have firewall protection Cyberoam Console guide helps you administer monitor and manage Cyberoam with the help of Console Note that by default Cyberoam Console password is lsquoadminrsquo It is recommended to change the default password immediately after Installation

Guide Audience

Cyberoam Console Guide provides functional and technical information of the Cyberoam Software This Guide is written to serve as a technical reference and describes features that are specific to the Console Guide also provides the brief summary on using the Console commands This guide is intended for the Network Administrators and Support personnel who perform the following tasks bull Configure System amp Network bull Manage and maintain Network bull Manage various services bull Troubleshooting This guide is intended for reference purpose and readers are expected to possess basic-to-advanced knowledge of systems networking

Note The Corporate and individual names data and images in this guide are for demonstration purposes only and does not reflect the real data

If you are new to Cyberoam use this guide along with the lsquoCyberoam User Guidersquo

Cyberoam Console Guide

2

Technical Support

You may direct all questions comments or requests concerning the software you purchased your registration status or similar issues to Customer careservice department at the following address Corporate Office eLitecore Technologies Ltd 904 Silicon Tower Off CG Road Ahmedabad 380015 Gujarat India Phone +91-79-66065606 Fax +91-79-26407640 Web site wwwelitecorecom Cyberoam contact Technical support (Corporate Office) +91-79- 26400707 Email supportcyberoamcom Web site wwwcyberoamcom Visit wwwcyberoamcom for the regional and latest contact information

Cyberoam Console Guide

3

Typographic Conventions

Material in this manual is presented in text screen displays or command-line notation

Item Convention Example

Server Machine where Cyberoam Software - Server component is installed

Client Machine where Cyberoam Software - Client component is installed

User The end user Username Username uniquely identifies the user of the system Topic titles Shaded font

typefaces Introduction

Subtitles Bold and Black typefaces

Notation conventions

Navigation link

Bold typeface

Group Management rarr Groups rarr Create it means to open the required page click on Group management then on Groups and finally click Create tab

Notes amp points to remember

Bold typeface between the black borders

Note

Cyberoam Console Guide

4

Introduction Cyberoam CLI console provides a collection of tools to administer monitor and control certain Cyberoam components

Accessing Cyberoam CLI Console Two ways to access Cyberoam CLI console 1 Direct Console connection - attaching a keyboard and monitor directly to the Cyberoam 2 Remote connection a) Using remote login utility ndash TELNET b) Using SSH client

Accessing CLI Console via remote login utility - TELNET

To use TELNET IP Address of the Cyberoam is required Use command ldquotelnet ltCyberoam IP addressgtrdquo to start TELNET utility from command prompt and log on with default password ldquoadminrdquo

Screen - Console login screen

Accessing CLI Console using SSH client

Access Cyberoam CLI console using any of the SSH client Cyberoam IP Address is required Start SSH client and create new Connection with the following parameters Hostname - ltCyberoam IP Addressgt Username ndash admin Password ndash admin On successful login following Main menu screen will be shown

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 3: Cyberoam Console Guide

Cyberoam Console Guide

1

Contents

Preface 1 Guide Audience 1 Technical Support 2 Typographic Conventions 3

Introduction 4 Accessing Cyberoam CLI Console 4

Accessing CLI Console via remote login utility - TELNET 4 Accessing CLI Console using SSH client 4

R Restart Management Services 6 1 Network configuration 7

For Gateway mode 7 For Transparent (bridge) mode 8

11 IP address configuration 9 12 Add Alias 9 13 Remove Alias 10 14 Remove All Alias 10 15 VLAN Management 11 151 Add VLAN ID 11 152 Remove VLAN ID 12 153 Show VLAN ID Configuration 13 150 Exit 13

10 Exit 13 2 System configuration 14

21 Set Console Password 14 22 Set System Date 14 23 View Access logs 15 24 Set Cyberoam Administrator Email ID 16 25 Traceroute Utility 17 26 Set Module Info 17 27 Bandwidth Graph Setting 17

271 Flush Gateway Graphs 18 272 Flush System Health Graphs 18 273 Flush All Bandwidth Graphs 18 270 Exit 18

28 EnableDisable LAN Bypass 18 20 Exit 18

3 Route configuration 19 31 Configure Unicast Routing 19

311 Configure Static-routesACLs 19 312 Configure RIP 21 313 Configure OSPF 23 313 Configure Border Gateway Protocol (BGP) 25 310 Exit 26

32 Configure Multicast Routing 27 321 EnableDisable Multicast forwarding 28 322 Configure Static multicast routes 29 320 Exit 30

30 Exit 30 4 Cyberoam Console 31 5 Cyberoam Management 32

51 Restart Management Services 32 52 Remove Firewall Rules 32 53 Reset Management Password 33

Cyberoam Console Guide

2

54 Database Utilities 33 541 Database Quick Repair 33 542 Database Full Repair 34 543 Repair Web Surfing logs 34 544 Repair User Session logs 34 545 Repair Live User Data 34 546 Synchronize Live User Data 34 547 Repair Summary table Data 34 540 Exit 34

55 Download Backup 35 56 Restore Backup 35 57 DHCP Client Settings 35 58 View Audit Logs 36 59 Check and Upgrade New version 36 510 Auto Upgrade status 36 511 Check and Update Webcat Latest Database 36 512 Webcat Auto Upgrade Status 37 513 Reset to Factory Defaults 37 514 Custom Menu 37 515 HA Configuration 37

5151 Disable HA 37 5152 Reset HA 38 5153 Show details 38 5150 Exit 38

516 Rollback to previous version 38 517 ReBuild New Firewall State 39 50 Exit 39

6 Upgrade version 40 7 Bandwidth Monitor 40 8 VPN Management 41

81 Regenerate RSA Key 41 82 Restart VPN service 42 83 View VPN Logs 42 83 View Connection wise VPN Logs 42 84 View Connection wise VPN Logs 42 85 Advance VPN Logs 43 86 PPTP VPN Logs 43 80 Exit 43

9 ShutdownReboot Cyberoam 44 0 Exit 44 Annexure A 45

Change Log 65

Cyberoam Console Guide

3

Annexure I - Contents

arp 45

clear 45

cyberoam45

disableremote46

dnslookup 46

enableremote 47

httpclient 47

ip 47

message52

packet-capture 52

ping 53

route54

set 55

show 59

tcpdump 61

telnet 63

traceroute64

Cyberoam Console Guide

1

Preface Welcome to Cyberoamrsquos ndash Console guide Cyberoam is an Identity-based UTM Appliance Cyberoamrsquos solution is purpose-built to meet the security needs of corporate government organizations and educational institutions Cyberoamrsquos perfect blend of best-of-breed solutions includes user based Firewall Content filtering Anti Virus Anti Spam Intrusion Prevention System (IPS) and VPN Cyberoam provides increased LAN security by providing separate port for connecting to the publicly accessible servers like Web server Mail server FTP server etc hosted in DMZ which are visible the external world and still have firewall protection Cyberoam Console guide helps you administer monitor and manage Cyberoam with the help of Console Note that by default Cyberoam Console password is lsquoadminrsquo It is recommended to change the default password immediately after Installation

Guide Audience

Cyberoam Console Guide provides functional and technical information of the Cyberoam Software This Guide is written to serve as a technical reference and describes features that are specific to the Console Guide also provides the brief summary on using the Console commands This guide is intended for the Network Administrators and Support personnel who perform the following tasks bull Configure System amp Network bull Manage and maintain Network bull Manage various services bull Troubleshooting This guide is intended for reference purpose and readers are expected to possess basic-to-advanced knowledge of systems networking

Note The Corporate and individual names data and images in this guide are for demonstration purposes only and does not reflect the real data

If you are new to Cyberoam use this guide along with the lsquoCyberoam User Guidersquo

Cyberoam Console Guide

2

Technical Support

You may direct all questions comments or requests concerning the software you purchased your registration status or similar issues to Customer careservice department at the following address Corporate Office eLitecore Technologies Ltd 904 Silicon Tower Off CG Road Ahmedabad 380015 Gujarat India Phone +91-79-66065606 Fax +91-79-26407640 Web site wwwelitecorecom Cyberoam contact Technical support (Corporate Office) +91-79- 26400707 Email supportcyberoamcom Web site wwwcyberoamcom Visit wwwcyberoamcom for the regional and latest contact information

Cyberoam Console Guide

3

Typographic Conventions

Material in this manual is presented in text screen displays or command-line notation

Item Convention Example

Server Machine where Cyberoam Software - Server component is installed

Client Machine where Cyberoam Software - Client component is installed

User The end user Username Username uniquely identifies the user of the system Topic titles Shaded font

typefaces Introduction

Subtitles Bold and Black typefaces

Notation conventions

Navigation link

Bold typeface

Group Management rarr Groups rarr Create it means to open the required page click on Group management then on Groups and finally click Create tab

Notes amp points to remember

Bold typeface between the black borders

Note

Cyberoam Console Guide

4

Introduction Cyberoam CLI console provides a collection of tools to administer monitor and control certain Cyberoam components

Accessing Cyberoam CLI Console Two ways to access Cyberoam CLI console 1 Direct Console connection - attaching a keyboard and monitor directly to the Cyberoam 2 Remote connection a) Using remote login utility ndash TELNET b) Using SSH client

Accessing CLI Console via remote login utility - TELNET

To use TELNET IP Address of the Cyberoam is required Use command ldquotelnet ltCyberoam IP addressgtrdquo to start TELNET utility from command prompt and log on with default password ldquoadminrdquo

Screen - Console login screen

Accessing CLI Console using SSH client

Access Cyberoam CLI console using any of the SSH client Cyberoam IP Address is required Start SSH client and create new Connection with the following parameters Hostname - ltCyberoam IP Addressgt Username ndash admin Password ndash admin On successful login following Main menu screen will be shown

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 4: Cyberoam Console Guide

Cyberoam Console Guide

2

54 Database Utilities 33 541 Database Quick Repair 33 542 Database Full Repair 34 543 Repair Web Surfing logs 34 544 Repair User Session logs 34 545 Repair Live User Data 34 546 Synchronize Live User Data 34 547 Repair Summary table Data 34 540 Exit 34

55 Download Backup 35 56 Restore Backup 35 57 DHCP Client Settings 35 58 View Audit Logs 36 59 Check and Upgrade New version 36 510 Auto Upgrade status 36 511 Check and Update Webcat Latest Database 36 512 Webcat Auto Upgrade Status 37 513 Reset to Factory Defaults 37 514 Custom Menu 37 515 HA Configuration 37

5151 Disable HA 37 5152 Reset HA 38 5153 Show details 38 5150 Exit 38

516 Rollback to previous version 38 517 ReBuild New Firewall State 39 50 Exit 39

6 Upgrade version 40 7 Bandwidth Monitor 40 8 VPN Management 41

81 Regenerate RSA Key 41 82 Restart VPN service 42 83 View VPN Logs 42 83 View Connection wise VPN Logs 42 84 View Connection wise VPN Logs 42 85 Advance VPN Logs 43 86 PPTP VPN Logs 43 80 Exit 43

9 ShutdownReboot Cyberoam 44 0 Exit 44 Annexure A 45

Change Log 65

Cyberoam Console Guide

3

Annexure I - Contents

arp 45

clear 45

cyberoam45

disableremote46

dnslookup 46

enableremote 47

httpclient 47

ip 47

message52

packet-capture 52

ping 53

route54

set 55

show 59

tcpdump 61

telnet 63

traceroute64

Cyberoam Console Guide

1

Preface Welcome to Cyberoamrsquos ndash Console guide Cyberoam is an Identity-based UTM Appliance Cyberoamrsquos solution is purpose-built to meet the security needs of corporate government organizations and educational institutions Cyberoamrsquos perfect blend of best-of-breed solutions includes user based Firewall Content filtering Anti Virus Anti Spam Intrusion Prevention System (IPS) and VPN Cyberoam provides increased LAN security by providing separate port for connecting to the publicly accessible servers like Web server Mail server FTP server etc hosted in DMZ which are visible the external world and still have firewall protection Cyberoam Console guide helps you administer monitor and manage Cyberoam with the help of Console Note that by default Cyberoam Console password is lsquoadminrsquo It is recommended to change the default password immediately after Installation

Guide Audience

Cyberoam Console Guide provides functional and technical information of the Cyberoam Software This Guide is written to serve as a technical reference and describes features that are specific to the Console Guide also provides the brief summary on using the Console commands This guide is intended for the Network Administrators and Support personnel who perform the following tasks bull Configure System amp Network bull Manage and maintain Network bull Manage various services bull Troubleshooting This guide is intended for reference purpose and readers are expected to possess basic-to-advanced knowledge of systems networking

Note The Corporate and individual names data and images in this guide are for demonstration purposes only and does not reflect the real data

If you are new to Cyberoam use this guide along with the lsquoCyberoam User Guidersquo

Cyberoam Console Guide

2

Technical Support

You may direct all questions comments or requests concerning the software you purchased your registration status or similar issues to Customer careservice department at the following address Corporate Office eLitecore Technologies Ltd 904 Silicon Tower Off CG Road Ahmedabad 380015 Gujarat India Phone +91-79-66065606 Fax +91-79-26407640 Web site wwwelitecorecom Cyberoam contact Technical support (Corporate Office) +91-79- 26400707 Email supportcyberoamcom Web site wwwcyberoamcom Visit wwwcyberoamcom for the regional and latest contact information

Cyberoam Console Guide

3

Typographic Conventions

Material in this manual is presented in text screen displays or command-line notation

Item Convention Example

Server Machine where Cyberoam Software - Server component is installed

Client Machine where Cyberoam Software - Client component is installed

User The end user Username Username uniquely identifies the user of the system Topic titles Shaded font

typefaces Introduction

Subtitles Bold and Black typefaces

Notation conventions

Navigation link

Bold typeface

Group Management rarr Groups rarr Create it means to open the required page click on Group management then on Groups and finally click Create tab

Notes amp points to remember

Bold typeface between the black borders

Note

Cyberoam Console Guide

4

Introduction Cyberoam CLI console provides a collection of tools to administer monitor and control certain Cyberoam components

Accessing Cyberoam CLI Console Two ways to access Cyberoam CLI console 1 Direct Console connection - attaching a keyboard and monitor directly to the Cyberoam 2 Remote connection a) Using remote login utility ndash TELNET b) Using SSH client

Accessing CLI Console via remote login utility - TELNET

To use TELNET IP Address of the Cyberoam is required Use command ldquotelnet ltCyberoam IP addressgtrdquo to start TELNET utility from command prompt and log on with default password ldquoadminrdquo

Screen - Console login screen

Accessing CLI Console using SSH client

Access Cyberoam CLI console using any of the SSH client Cyberoam IP Address is required Start SSH client and create new Connection with the following parameters Hostname - ltCyberoam IP Addressgt Username ndash admin Password ndash admin On successful login following Main menu screen will be shown

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 5: Cyberoam Console Guide

Cyberoam Console Guide

3

Annexure I - Contents

arp 45

clear 45

cyberoam45

disableremote46

dnslookup 46

enableremote 47

httpclient 47

ip 47

message52

packet-capture 52

ping 53

route54

set 55

show 59

tcpdump 61

telnet 63

traceroute64

Cyberoam Console Guide

1

Preface Welcome to Cyberoamrsquos ndash Console guide Cyberoam is an Identity-based UTM Appliance Cyberoamrsquos solution is purpose-built to meet the security needs of corporate government organizations and educational institutions Cyberoamrsquos perfect blend of best-of-breed solutions includes user based Firewall Content filtering Anti Virus Anti Spam Intrusion Prevention System (IPS) and VPN Cyberoam provides increased LAN security by providing separate port for connecting to the publicly accessible servers like Web server Mail server FTP server etc hosted in DMZ which are visible the external world and still have firewall protection Cyberoam Console guide helps you administer monitor and manage Cyberoam with the help of Console Note that by default Cyberoam Console password is lsquoadminrsquo It is recommended to change the default password immediately after Installation

Guide Audience

Cyberoam Console Guide provides functional and technical information of the Cyberoam Software This Guide is written to serve as a technical reference and describes features that are specific to the Console Guide also provides the brief summary on using the Console commands This guide is intended for the Network Administrators and Support personnel who perform the following tasks bull Configure System amp Network bull Manage and maintain Network bull Manage various services bull Troubleshooting This guide is intended for reference purpose and readers are expected to possess basic-to-advanced knowledge of systems networking

Note The Corporate and individual names data and images in this guide are for demonstration purposes only and does not reflect the real data

If you are new to Cyberoam use this guide along with the lsquoCyberoam User Guidersquo

Cyberoam Console Guide

2

Technical Support

You may direct all questions comments or requests concerning the software you purchased your registration status or similar issues to Customer careservice department at the following address Corporate Office eLitecore Technologies Ltd 904 Silicon Tower Off CG Road Ahmedabad 380015 Gujarat India Phone +91-79-66065606 Fax +91-79-26407640 Web site wwwelitecorecom Cyberoam contact Technical support (Corporate Office) +91-79- 26400707 Email supportcyberoamcom Web site wwwcyberoamcom Visit wwwcyberoamcom for the regional and latest contact information

Cyberoam Console Guide

3

Typographic Conventions

Material in this manual is presented in text screen displays or command-line notation

Item Convention Example

Server Machine where Cyberoam Software - Server component is installed

Client Machine where Cyberoam Software - Client component is installed

User The end user Username Username uniquely identifies the user of the system Topic titles Shaded font

typefaces Introduction

Subtitles Bold and Black typefaces

Notation conventions

Navigation link

Bold typeface

Group Management rarr Groups rarr Create it means to open the required page click on Group management then on Groups and finally click Create tab

Notes amp points to remember

Bold typeface between the black borders

Note

Cyberoam Console Guide

4

Introduction Cyberoam CLI console provides a collection of tools to administer monitor and control certain Cyberoam components

Accessing Cyberoam CLI Console Two ways to access Cyberoam CLI console 1 Direct Console connection - attaching a keyboard and monitor directly to the Cyberoam 2 Remote connection a) Using remote login utility ndash TELNET b) Using SSH client

Accessing CLI Console via remote login utility - TELNET

To use TELNET IP Address of the Cyberoam is required Use command ldquotelnet ltCyberoam IP addressgtrdquo to start TELNET utility from command prompt and log on with default password ldquoadminrdquo

Screen - Console login screen

Accessing CLI Console using SSH client

Access Cyberoam CLI console using any of the SSH client Cyberoam IP Address is required Start SSH client and create new Connection with the following parameters Hostname - ltCyberoam IP Addressgt Username ndash admin Password ndash admin On successful login following Main menu screen will be shown

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 6: Cyberoam Console Guide

Cyberoam Console Guide

1

Preface Welcome to Cyberoamrsquos ndash Console guide Cyberoam is an Identity-based UTM Appliance Cyberoamrsquos solution is purpose-built to meet the security needs of corporate government organizations and educational institutions Cyberoamrsquos perfect blend of best-of-breed solutions includes user based Firewall Content filtering Anti Virus Anti Spam Intrusion Prevention System (IPS) and VPN Cyberoam provides increased LAN security by providing separate port for connecting to the publicly accessible servers like Web server Mail server FTP server etc hosted in DMZ which are visible the external world and still have firewall protection Cyberoam Console guide helps you administer monitor and manage Cyberoam with the help of Console Note that by default Cyberoam Console password is lsquoadminrsquo It is recommended to change the default password immediately after Installation

Guide Audience

Cyberoam Console Guide provides functional and technical information of the Cyberoam Software This Guide is written to serve as a technical reference and describes features that are specific to the Console Guide also provides the brief summary on using the Console commands This guide is intended for the Network Administrators and Support personnel who perform the following tasks bull Configure System amp Network bull Manage and maintain Network bull Manage various services bull Troubleshooting This guide is intended for reference purpose and readers are expected to possess basic-to-advanced knowledge of systems networking

Note The Corporate and individual names data and images in this guide are for demonstration purposes only and does not reflect the real data

If you are new to Cyberoam use this guide along with the lsquoCyberoam User Guidersquo

Cyberoam Console Guide

2

Technical Support

You may direct all questions comments or requests concerning the software you purchased your registration status or similar issues to Customer careservice department at the following address Corporate Office eLitecore Technologies Ltd 904 Silicon Tower Off CG Road Ahmedabad 380015 Gujarat India Phone +91-79-66065606 Fax +91-79-26407640 Web site wwwelitecorecom Cyberoam contact Technical support (Corporate Office) +91-79- 26400707 Email supportcyberoamcom Web site wwwcyberoamcom Visit wwwcyberoamcom for the regional and latest contact information

Cyberoam Console Guide

3

Typographic Conventions

Material in this manual is presented in text screen displays or command-line notation

Item Convention Example

Server Machine where Cyberoam Software - Server component is installed

Client Machine where Cyberoam Software - Client component is installed

User The end user Username Username uniquely identifies the user of the system Topic titles Shaded font

typefaces Introduction

Subtitles Bold and Black typefaces

Notation conventions

Navigation link

Bold typeface

Group Management rarr Groups rarr Create it means to open the required page click on Group management then on Groups and finally click Create tab

Notes amp points to remember

Bold typeface between the black borders

Note

Cyberoam Console Guide

4

Introduction Cyberoam CLI console provides a collection of tools to administer monitor and control certain Cyberoam components

Accessing Cyberoam CLI Console Two ways to access Cyberoam CLI console 1 Direct Console connection - attaching a keyboard and monitor directly to the Cyberoam 2 Remote connection a) Using remote login utility ndash TELNET b) Using SSH client

Accessing CLI Console via remote login utility - TELNET

To use TELNET IP Address of the Cyberoam is required Use command ldquotelnet ltCyberoam IP addressgtrdquo to start TELNET utility from command prompt and log on with default password ldquoadminrdquo

Screen - Console login screen

Accessing CLI Console using SSH client

Access Cyberoam CLI console using any of the SSH client Cyberoam IP Address is required Start SSH client and create new Connection with the following parameters Hostname - ltCyberoam IP Addressgt Username ndash admin Password ndash admin On successful login following Main menu screen will be shown

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 7: Cyberoam Console Guide

Cyberoam Console Guide

2

Technical Support

You may direct all questions comments or requests concerning the software you purchased your registration status or similar issues to Customer careservice department at the following address Corporate Office eLitecore Technologies Ltd 904 Silicon Tower Off CG Road Ahmedabad 380015 Gujarat India Phone +91-79-66065606 Fax +91-79-26407640 Web site wwwelitecorecom Cyberoam contact Technical support (Corporate Office) +91-79- 26400707 Email supportcyberoamcom Web site wwwcyberoamcom Visit wwwcyberoamcom for the regional and latest contact information

Cyberoam Console Guide

3

Typographic Conventions

Material in this manual is presented in text screen displays or command-line notation

Item Convention Example

Server Machine where Cyberoam Software - Server component is installed

Client Machine where Cyberoam Software - Client component is installed

User The end user Username Username uniquely identifies the user of the system Topic titles Shaded font

typefaces Introduction

Subtitles Bold and Black typefaces

Notation conventions

Navigation link

Bold typeface

Group Management rarr Groups rarr Create it means to open the required page click on Group management then on Groups and finally click Create tab

Notes amp points to remember

Bold typeface between the black borders

Note

Cyberoam Console Guide

4

Introduction Cyberoam CLI console provides a collection of tools to administer monitor and control certain Cyberoam components

Accessing Cyberoam CLI Console Two ways to access Cyberoam CLI console 1 Direct Console connection - attaching a keyboard and monitor directly to the Cyberoam 2 Remote connection a) Using remote login utility ndash TELNET b) Using SSH client

Accessing CLI Console via remote login utility - TELNET

To use TELNET IP Address of the Cyberoam is required Use command ldquotelnet ltCyberoam IP addressgtrdquo to start TELNET utility from command prompt and log on with default password ldquoadminrdquo

Screen - Console login screen

Accessing CLI Console using SSH client

Access Cyberoam CLI console using any of the SSH client Cyberoam IP Address is required Start SSH client and create new Connection with the following parameters Hostname - ltCyberoam IP Addressgt Username ndash admin Password ndash admin On successful login following Main menu screen will be shown

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 8: Cyberoam Console Guide

Cyberoam Console Guide

3

Typographic Conventions

Material in this manual is presented in text screen displays or command-line notation

Item Convention Example

Server Machine where Cyberoam Software - Server component is installed

Client Machine where Cyberoam Software - Client component is installed

User The end user Username Username uniquely identifies the user of the system Topic titles Shaded font

typefaces Introduction

Subtitles Bold and Black typefaces

Notation conventions

Navigation link

Bold typeface

Group Management rarr Groups rarr Create it means to open the required page click on Group management then on Groups and finally click Create tab

Notes amp points to remember

Bold typeface between the black borders

Note

Cyberoam Console Guide

4

Introduction Cyberoam CLI console provides a collection of tools to administer monitor and control certain Cyberoam components

Accessing Cyberoam CLI Console Two ways to access Cyberoam CLI console 1 Direct Console connection - attaching a keyboard and monitor directly to the Cyberoam 2 Remote connection a) Using remote login utility ndash TELNET b) Using SSH client

Accessing CLI Console via remote login utility - TELNET

To use TELNET IP Address of the Cyberoam is required Use command ldquotelnet ltCyberoam IP addressgtrdquo to start TELNET utility from command prompt and log on with default password ldquoadminrdquo

Screen - Console login screen

Accessing CLI Console using SSH client

Access Cyberoam CLI console using any of the SSH client Cyberoam IP Address is required Start SSH client and create new Connection with the following parameters Hostname - ltCyberoam IP Addressgt Username ndash admin Password ndash admin On successful login following Main menu screen will be shown

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 9: Cyberoam Console Guide

Cyberoam Console Guide

4

Introduction Cyberoam CLI console provides a collection of tools to administer monitor and control certain Cyberoam components

Accessing Cyberoam CLI Console Two ways to access Cyberoam CLI console 1 Direct Console connection - attaching a keyboard and monitor directly to the Cyberoam 2 Remote connection a) Using remote login utility ndash TELNET b) Using SSH client

Accessing CLI Console via remote login utility - TELNET

To use TELNET IP Address of the Cyberoam is required Use command ldquotelnet ltCyberoam IP addressgtrdquo to start TELNET utility from command prompt and log on with default password ldquoadminrdquo

Screen - Console login screen

Accessing CLI Console using SSH client

Access Cyberoam CLI console using any of the SSH client Cyberoam IP Address is required Start SSH client and create new Connection with the following parameters Hostname - ltCyberoam IP Addressgt Username ndash admin Password ndash admin On successful login following Main menu screen will be shown

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 10: Cyberoam Console Guide

Cyberoam Console Guide

5

To access any of the menu items type the number corresponding to the menu item against lsquoSelect Menu Numberrsquo and press ltEntergt key Example To access Type System Configuration 2 DNS services 8 Exit 0 or Ctrl -C

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 11: Cyberoam Console Guide

Cyberoam Console Guide

6

R Restart Management Services Use to restart Cyberoam management services It will restart all the Cyberoam services To minimize the startup time instead of re-applying each firewall rule again RMS simply stores the firewall state snapshot and restores the firewall state Message lsquoRestarting Authentication service Donersquo displayed Press ltEntergt to return to the Main menu

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 12: Cyberoam Console Guide

Cyberoam Console Guide

7

1 Network configuration Use this menu to bull View amp change network setting bull Set IP address bull Set Alias (only when Cyberoam is deployed in transparent mode) bull Add VLAN ID (only when Cyberoam is deployed in transparent mode)

For Gateway mode

Following screen displays the current Network setting like IP address amp Net mask for all the Ports In addition it also displays IP address and Net mask of Aliases if configured

Set IP Address Following screen allows setting or modifying the IP address for any port Type lsquoyrsquo and press ltEntergt to set IP address

Displays the IP address Net mask and Zone and prompts for the new IP address and Net mask for each Port Press ltEntergt if you do not want to change any details

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 13: Cyberoam Console Guide

Cyberoam Console Guide

8

Note One can assign or bind more than one IP address to the same Ethernet or the Network card These are Aliases It is possible to define Aliases for both Internal as well as External network Maximum eight IP addresses (Aliases) can be bound to a single Network card

Displays message on successful completion of the operation and restarts management services Press ltEntergt to return to the Main menu

For Transparent (bridge) mode

Use the menu to set or change the IP address add and remove alias add and remove VLAN ID

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 14: Cyberoam Console Guide

Cyberoam Console Guide

9

11 IP address configuration

Screen displays the current IP address Type lsquoyrsquo and press ltEntergt to set IP address It prompts for the new IP address and Net mask Specify IP address and press ltEntergt if you do not want to change netmask Cyberoam will take some time to restart as it automatically restarts management services once you change the IP address

12 Add Alias

Use to add interface alias Specify number of aliases to be added Specify IP address and netmask for Alias You will be prompted to restart management services (RMS) after alias is added successfully Unless you do RMS you will not be able to use Alias

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 15: Cyberoam Console Guide

Cyberoam Console Guide

10

13 Remove Alias

Use to remove interface aliases All the configured aliases are displayed Specify Alias number to be removed and follow the screen steps You will be prompted to restart management services (RMS) after alias is removed successfully

14 Remove All Alias

Use to remove all the configured aliases in one step You will be prompted to restart management services (RMS) after aliases are removed successfully

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 16: Cyberoam Console Guide

Cyberoam Console Guide

11

15 VLAN Management

Use to add remove or view VLAN IDs

151 Add VLAN ID

Screen displays list of VLAN IDs if configured for bridge interface and prompts to specify new VLAN ID VLAN ID can be any number between 2 and 4094

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 17: Cyberoam Console Guide

Cyberoam Console Guide

12

Error ldquoInvalid VLAN_idrdquo is displayed if VLAN ID is not between 2 and 4094

152 Remove VLAN ID

Use to remove configured VLAN IDs Screen displays list of all the configured VLAN IDs for the bridge interface and prompts to specify VLAN ID to be removed

Error ldquoEntry VLAN_xx Does Not Existsrdquo if one specifies VLAN ID which is not added

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 18: Cyberoam Console Guide

Cyberoam Console Guide

13

153 Show VLAN ID Configuration

Use to view list of VLAN IDs added for the bridge interface

150 Exit

Type lsquo0rsquo to exit from VLAN configuration menu

10 Exit

Type lsquo0rsquo to exit from Transparent mode IP configuration menu

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 19: Cyberoam Console Guide

Cyberoam Console Guide

14

2 System configuration Use this menu to bull View amp change various system properties

21 Set Console Password

Use to change the Console password Type new password retype for confirmation and press ltEntergt

Displays message on successful completion of the operation Press ltEntergt to return to the System Setting Menu

22 Set System Date

Use to change time zone and system date Type lsquoyrsquo to set new time and press ltEntergt

Select the appropriate zone by using lsquoTabrsquo key and press lsquoOKrsquo followed by ltEntergt

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 20: Cyberoam Console Guide

Cyberoam Console Guide

15

Type lsquoyrsquo to reset Date and press ltEntergt Type Month Day Year Hour Minutes

Press ltEntergt to return to the System Menu

23 View Access logs

Use to view Access log Displays list of IP addresses from where the Console was accessed along with Date amp time

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 21: Cyberoam Console Guide

Cyberoam Console Guide

16

24 Set Cyberoam Administrator Email ID

Use to change the Email ID of Cyberoam Administrator Cyberoam sends system alert mails on the specified Email ID Type Email ID and press ltEntergt It displays the new Email ID

Press ltEntergt to return to the System Setting Menu

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 22: Cyberoam Console Guide

Cyberoam Console Guide

17

25 Traceroute Utility

Use to trace the path taken by a packet from the source system to the destination system over the Internet The typical path taken by data packets sent by the source to the destination has been depicted by the below figure Source System rarr Router of the Source Network rarr Router of the Source Networkrsquos ISP rarr Router of the Destinationrsquos ISP rarr Router of the Destination Network rarr Destination System Traceroute displays all the routers through which data packets pass on way to the destination system from the source system Thus in effect we come to know the exact path taken by the data packets in the data transit

Press ltEntergt to return to the System Setting Menu

26 Set Module Info

Use to add the NIC details after the Card is added physically

27 Bandwidth Graph Setting

Cyberoam generates Gateway wise ndash Total and Composite as well as Host Group wise bandwidth usage graphs which allows Administrator to monitor the amount of data uploaded or downloaded If the graphs are generated with erroneous data due to data corruption the analysis of the graphs will results into wrong information To flush the bandwidth graphs generated with erroneous data use this option

Flushing deletes graph and along with the data with which the graph was generated Graphs generated after flushing will be generated using the new data

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 23: Cyberoam Console Guide

Cyberoam Console Guide

18

271 Flush Gateway Graphs

Use to flush the graph generated for different Gateways defined in the Cyberoam

272 Flush System Health Graphs

Use to flush system health graphs which are displayed in diagnostic tools (dghtml)

273 Flush All Bandwidth Graphs

Use to flush all the Bandwidth graphs generated

270 Exit

Type lsquo0rsquo to exit from the Bandwidth Graph Menu and return to the System Settings Menu

28 EnableDisable LAN Bypass

Use to enabledisable LAN Bypass Option available only if Cyberoam is deployed in Bridge mode

20 Exit

Type lsquo0rsquo to exit from System Setting menu and return to the Main Menu

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 24: Cyberoam Console Guide

Cyberoam Console Guide

19

3 Route configuration Use to this menu to configure static routes RIP OSPF and enable or disable multicast forwarding Cyberoam adheres to Cisco terminology for routing configuration and provides Cisco-compliant CLI to configure static routes and dynamic routing protocols Traditionally IP packets are transmitted in one of either two ways ndash Unicast (1 sender ndash 1 receiver) or Broadcast (1 sender ndash everybody on the network) Multicast delivers IP packets simultaneously to a group of hosts on the network and not everybody and not just 1

31 Configure Unicast Routing

Options Configure RIP Configure OSPF and Configure BGP are not available when Cyberoam is deployed in transparent mode

311 Configure Static-routesACLs

bull Use to add and remove static routes A route provides the Cyberoam with the information it needs to forward a packet to a particular destination A static route causes packets to be forwarded to a destination other than the configured default gateway By specifying through which interface the packet will leave and to which device the packet should be routed static routes to control the traffic exiting the Cyberoam Configure static routes by defining the destination IP address and netmask of packets that the Cyberoam is intended to intercept and specifying a (gateway or next hop) IP address for those packets The gateway address specifies the next-hop router to which traffic will be routed Creating static routes 1 Go to option 1 Configure Static-routesACLs

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 25: Cyberoam Console Guide

Cyberoam Console Guide

20

2 To enable the configuration mode execute lsquoenablersquo command from the command prompt as below routergt enable ltcrgt

3 To enter the global configuration mode execute the lsquoconfigure terminalrsquo command from the command prompt as below router configure terminal ltcrgt

4 Specify destination IP addressnetwork and gateway (next hop) using lsquoip routersquo command from the command prompt as below router(config) ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt

Viewing static routes To view the static route configuration use the lsquoshow running-configrsquo command from the command prompt as below

routergt show ip route ltcrgt

Removing static routes To remove the static route configuration execute the lsquono ip routersquo command from the command prompt as below

router(config) no ip route ltdestination ip addressnetmaskgt ltgateway ip addressgt Execute lsquoexitrsquo command to return to the previous mode

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 26: Cyberoam Console Guide

Cyberoam Console Guide

21

312 Configure RIP

This option is available only when Cyberoam is deployed in Gateway mode Routing Information Protocol (RIP) is a distance-vector routing protocol documented in RFC 1058 RIP uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information The Cyberoam implementation of RIP supports bull RIP version 1 (as described in RFC 1058) bull RIP version 2 (as described in RFC 2453) bull Plain text and Message Digest 5 (MD5) authentication for RIP Version 2

RIP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard RIP must be enabled before carrying out any of the RIP commands To configure RIP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 2 (Configure RIP) 4 To configure RIP perform the tasks described in the following table

Steps Command Purpose Enable RIP

ripgt enable Enables a RIP routing process and places you in Global Configuration mode

Specify a list of networks for the Routing Information Protocol (RIP) routing process

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

rip(configure) router rip Allows to configure and start RIP routing process

rip(configure-router) network ip-address Specify ip-address with the subnet information For example if the network for 1000024 is RIP enabled this would result in all the addresses from 10000 to 1000255 being enabled for RIP

Enables RIP interfaces between specified network address RIP routing updates will be sent and received only through interfaces on this network Also if the network of an interface is not specified the interface will not be advertised in any RIP update The interfaces which have addresses matching with network are enabled

rip(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 27: Cyberoam Console Guide

Cyberoam Console Guide

22

rip configure terminal Enables the RIP configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

Configure Authentication

To set authentication mode as text and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode text [string] For example rip(configure) interface A rip(configure-if) ip rip authentication mode text rip(configure-if) ip rip authentication string teststring To set authentication mode as MD5 and set the authentication string rip(configure) interface ifname rip(configure-if) ip rip authentication mode md5 [key-chain name of key chain] For example rip(configure) interface A rip(configure-if) ip rip authentication mode md5 key-chain testkeychain To disable authentication rip(configure) interface ifname rip(configure-if) no ip rip authentication mode For example disable authentication for interface A rip(configure) interface A rip(configure-if) no ip rip authentication mode

Defines authentication mode for the each interface By default authentication is on for all the interfaces If authentication is not required for any of the interface it is to be explicitly disabled RIP Version 1 does not support authentication RIP Version 2 supports Clear Text (simple password) or Keyed Message Digest 5 (MD5) authentication To enable authentication for RIP Version 2 packets and to specify the set of keys that can be used on an interface use the ip rip authentication key-chain command in interface configuration mode If authentication is not required for any of the interface use the no form of this command

rip(configure-if) end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

rip(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

rip(config-router) no network ltip addressgt Disabling RIP To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below rip(config) no router rip

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 28: Cyberoam Console Guide

Cyberoam Console Guide

23

Execute lsquoexitrsquo command to return to the previous mode

313 Configure OSPF

This option is available only when Cyberoam is deployed in Gateway mode OSPF is one of IGPs (Interior Gateway Protocols) Compared with RIP OSPF can serve much more networks and period of convergence is very short OSPF is widely used in large networks such as ISP backbone and enterprise networks The Cyberoam implementation of OSPF supports bull OSPF version 2 (as described in RFC 2328) bull Plain text and Message Digest 5 (MD5) authentication

How OSPF works OSPF keeps track of a complete topological database of all connections in the local network It is typically divided into logical areas linked by area border routers An area comprises a group of contiguous networks An area border router links one or more areas to the OSPF network backbone Cyberoam participates in OSPF communications when it has an interface to an OSPF area Cyberoam uses the OSPF Hello protocol to acquire neighbors in an area A neighbor is any router that has an interface to the same area as the Cyberoam After initial contact the Cyberoam exchanges Hello packets with its OSPF neighbors at regular intervals to confirm that the neighbors can be reached OSPF-enabled routers generate link-state advertisements and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online If OSPF network is stable link-state advertisements between OSPF neighbors does not occur A Link-State Advertisement (LSA) identifies the interfaces of all OSPF-enabled routers in an area and provides information that enables OSPF-enabled routers to select the shortest path to a destination All LSA exchanges between OSPF-enabled routers are authenticated The Cyberoam maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers To calculate the shortest path to a destination the Cyberoam applies the Shortest Path First (SPF) algorithm to the accumulated link-state information The Cyberoam updates its routing table dynamically based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination

OSFP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard OSPF must be enabled before carrying out any of the OSPF commands To configure OSPF use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 3 (Configure OSPF) 4 To configure OSPF perform the tasks described in the following table

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 29: Cyberoam Console Guide

Cyberoam Console Guide

24

Steps Command Purpose Enable OSPF

ospfgt enable Enables OSPF routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information Protocol (OSPF) routing process

ospf configure terminal Enables the OSPF configuration mode which places you in the Router Configuration mode and allows you to configure from the terminal

ospf(configure) router ospf Allows to configure and start OSPF routing process

ospf(configure-router) network ip-address area area-id Specify ip-address with the subnet information

Assigns an interface to a area The area-id is the area number we want the interface to be in The area-id can be an integer between 0 and 4294967295 or can take a form similar to an IP address ABCD Interfaces that are part of the network are advertised in OSPF link-state advertisements

ospf(config-router) show running-config

View configuration

ospf(configure-router)end Exits from the Router Configuration mode and places you into the Enable mode

Exit to Router Management Menu

ospf(configure-if) exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

ospf(config-router) no network ltip addressgt area ltarea-idgt Disabling OSPF To disable OSPF routing configuration execute the lsquono routerrsquo command from the command prompt as below ospf(config) no router ospf

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 30: Cyberoam Console Guide

Cyberoam Console Guide

25

313 Configure Border Gateway Protocol (BGP)

This option is available only when Cyberoam is deployed in Gateway mode BGP is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) eg BGP is typically used by ISPs to exchange routing information between different ISP networks The Cyberoam implementation of OSPF supports bull Version 4 (RFC 1771) bull Communities Attribute (RFC 1997) bull Route Reflection (RFC 2796) bull Multiprotocol extensions (RFC 2858) bull Capabilities Advertisement (RFC 2842) Additionally a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed ie LAN to LOCAL or WAN to LOCAL How BGP works When BGP is enabled the Cyberoam advertises routing table updates to neighboring autonomous systems whenever any part of the Cyberoam routing table changes Each AS including the local AS of which the Cyberoam unit is a member is associated with an AS number The AS number references a particular destination network BGP updates advertise the best path to a destination network When the Cyberoam unit receives a BGP update the Cyberoam examines potential routes to determine the best path to a destination network before recording the path in the Cyberoam routing table BGP configuration Task List Prerequisite Interface IP addresses configured from Network Configuration Wizard BGP must be enabled before carrying out any of the BGP commands To configure BGP use the following commands from CLI Console 1 Go to Option 3 (Route Configuration) 2 Go to Option 1 (Configure Unicast Routing) 3 Go to Option 4 (Configure BGP) 4 To configure BGP perform the tasks described in the following table

Steps Command Purpose Enable BGP

bgpgt enable Enables BGP routing process and places you in the Global Configuration mode

Specify a list of networks for the Routing Information

bgp configure terminal Enables the BGP configuration mode which places you in the Router Configuration mode and allows you to configure from the

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 31: Cyberoam Console Guide

Cyberoam Console Guide

26

Protocol (BGP) routing process

terminal

bgp(configure) router bgp AS number

Allows to configure and start BGP routing process AS number the number of the local AS that the Cyberoam unit is a member of

bgp(configure-router) network ip-address Specify ip-address with the subnet information of the network to be advertised

The IP addresses and network masks of networks to advertise to BGP peers The Cyberoam may have a physical or VLAN interface connected to those networks

bgp(config-router) show running-config

View configuration By default router ID is Cyberoam IP address Router ID is used to identify the Cyberoam to other BGP routers You can change the router ID using the following command bgp(config-router)bgp router-id IP address The router-id can be an integer or can take a form similar to an IP address ABCD

bgp(configure-router)end Exits from the Router Configuration mode

Exit to Router Management Menu

bgp exit Exits to the Router Management Menu

Removing routes To remove route configuration execute the lsquono networkrsquo command from the command prompt as below

bgp(config-router) no network ltip addressgt Disabling BGP To disable BGP routing configuration execute the lsquono routerrsquo command from the command prompt as below bgp(config) no router bgp AS number

310 Exit

Type lsquo0rsquo to exit from Unicast Routing configuration menu and return to Router Management

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 32: Cyberoam Console Guide

Cyberoam Console Guide

27

32 Configure Multicast Routing

IP Multicast Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes IP Multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers Applications like videoconferencing corporate communications distance learning and distribution of software stock quotes and news use IP multicasting If IP multicast is not used source is required to send more than one copy of a packet or individual copy to each receiver In such case high-bandwidth applications like Video or Stock where data is to be send more frequently and simultaneously uses large portion of the available bandwidth In these applications the only efficient way of sending information to more than one receiver simultaneously is by using IP Multicast Multicast Group Multicast is based on the concept of a group An arbitrary group of receivers expresses an interest in receiving a particular data stream This group does not have any physical or geographical boundariesmdashthe hosts can be located anywhere on the Internet Hosts that are interested in receiving data flowing to a particular group must join the group Hosts must be a member of the group to receive the data stream IP Multicast Addresses Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group IP Class D Addresses The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses Multicast addresses fall in Class D address space ranging from 224000 to 239255255255 This address range is only for the group address or destination address of IP multicast traffic The source address for multicast datagrams is always the unicast source address

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 33: Cyberoam Console Guide

Cyberoam Console Guide

28

Multicast forwarding In multicast routing the source is sending traffic to a group of hosts represented by a multicast group address The multicast router must determine which direction is upstream (toward the source) and which direction (or directions) is downstream If there are multiple downstream paths the router replicates the packet and forwards the traffic down the appropriate downstream pathsmdashwhich is not necessarily all paths

321 EnableDisable Multicast forwarding

With multicast forwarding a router forwards multicast traffic to networks where other multicast devices are listening Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening For multicast forwarding to work across inter-networks nodes and routers must be multicast-capable A multicast-capable node must be able to bull Send and receive multicast packets bull Register the multicast addresses being listened to by the node with local routers so that

multicast packets can be forwarded to the network of the node IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address IP multicasting applications that receive multicast traffic must inform the TCPIP protocol that they are listening for all traffic to a specified IP multicast address Setting up IP Multicast forwarding Configuring multicast forwarding is two step process bull Enable multicast forwarding (both the modes) bull Configure multicast routes (only in gateway mode) To enable multicast forwarding go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 1 (EnableDisable Multicast forwarding) and execute following command mroutergtenable multicast-forwarding

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 34: Cyberoam Console Guide

Cyberoam Console Guide

29

322 Configure Static multicast routes

Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command Multicast routes can not be added before enabling multicast forwarding mroutergt mroute add ltsource interfacegt ltsource ipaddressgt ltdestination ipaddressgt ltinterfacegt where source interface - interface from which the multicast traffic is supposed to arrive (interface that leads to the source of multicast traffic) source ipaddress ndash unicast IP address of source transmitting multicast traffic destination ipaddress ndash class D IP address (224000 to 239255255255) destination interface ndash interface on which you want to forward the multicast traffic (interface that leads to destination of multicast traffic) For example mroutergt mroute add eth0 1111 230112 230112 eth2 Cyberoam will forward multicast traffic received on interface eth0 from IP address 1111 to 230112 through interface eth2 If you want to inject multicast traffic to more than one interface you have to add routes for each destination interface For example mroutegt mroute add eth0 1111 230112 eth1 mroutegt mroute add eth0 1111 230112 eth2

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 35: Cyberoam Console Guide

Cyberoam Console Guide

30

Viewing routes Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute show

Removing route Go to Option 3 (Route Configuration)gt Option 2 (Configure Multicast Routing) Option 2 (Configure Static-routes) and execute following command mroutergt mroute del eth0 1111 230112 eth2

Please note bull Source and destination interfaces cannot be same for multicast route bull Multiple destination interfaces cannot be defined Route manipulation per interface is required

to adddelete such routes bull Non-Ethernet interfaces like - ipsec0 etc are not supported

320 Exit

Type lsquo0rsquo to exit from Multicast Routing Configuration menu and return to Router Management

30 Exit

Type lsquo0rsquo to exit from Routing tables menu and return to Main Menu

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 36: Cyberoam Console Guide

Cyberoam Console Guide

31

4 Cyberoam Console Use to perform various checks and view logs for troubleshooting Generally when using command line help one has to remember parametersarguments of the command or has to go to the help and check for the parameters Users using command line for the first time face difficulty in both the situation To remove the above difficulty Cyberoam has inbuilt help at the command prompt itself Press lsquoTabrsquo to view the list of commands supported

Type command and then press tab to view the list of argument(s) supported or required For example after typing ping press tab it shows what all parameters are required or allowed

Type command and then press question mark to view the list of argument(s) supported with its description For example after typing ping press question mark it shows what all parameters are required or allowed with description

Type Exit to return to the Main menu

Note Refer to Annexure A for the detailed help on various commands supported

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 37: Cyberoam Console Guide

Cyberoam Console Guide

32

5 Cyberoam Management Use this menu to bull Restart management services bull Reset Web management password bull Restore Backup bull Remove Firewall rules bull Manage various Databases bull SetupConfigure DHCP client bull View Audit logs bull Reset to factory defaults bull Configure HA

51 Restart Management Services

Use to restart Management service

Press ltEntergt to return to the Main menu

52 Remove Firewall Rules

Firewall defines certain rules that determine what traffic should be allowed in or out of the Internal network One can restrict access to certain IP addresses or domain names or block certain traffic by blocking the TCPIP ports used

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 38: Cyberoam Console Guide

Cyberoam Console Guide

33

By default Cyberoam does not allow outbound traffic to pass through Removing all the firewall rules will allow all the inbound and outbound traffic to pass through Cyberoam This option does not delete the firewall rules but allows bypassing firewall till the next RMS In other word it temporarily flushes all the rules to allow the traffic without any restriction Restart management services to reapply the firewall rules You will need to temporarily flush the firewall rules in case you have locked yourself outside Cyberoam ie are not able to access Cyberoam Web Console

53 Reset Management Password

Use to reset Web Admin Console password The password for the username lsquocyberoamrsquo is reset to lsquocyberrsquo

Press ltEntergt to return to the Main menu

54 Database Utilities

Use to repair databases in case of any corruption in data

541 Database Quick Repair

Use to repair database if User is not able to login and receives message lsquoLogin request unsuccessful Contact Administratorrsquo It does not repair any of the log tables Automatically restarts the Management services

Note Use Database full repair if you want to repair all databases along with log tables

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 39: Cyberoam Console Guide

Cyberoam Console Guide

34

To repair only the log tables use the respective repair log options

542 Database Full Repair

Use this repair if any inconsistency found in any of the log data tables or user database Automatically restarts the Management services Use this option rarely as the time taken to repair the full database is directly proportional to the size of log tables Use the full repair option if the system was shut down abnormally and is giving some unexpected results Database quick repair is a more preferred option

543 Repair Web Surfing logs

Use to repair Web surfing log tables if any inconsistency found in the log data tables Web surfing log stores the information of all the websites visited by all the users

544 Repair User Session logs

Use to repair User Session log tables Use this option when user accounting reports are not coming or are mismatched Also use this option if there is some problem in user logout This might be because the user accounting record is not being put into the user session table Every time the user logs in session is created User session log stores the session entries of all the users and specifies the login and logout time

545 Repair Live User Data

Use to repair Live User data table if user loginlogout is being affected This table stores the currentlive user data

546 Synchronize Live User Data

Use this option if a certain user is not able to logon into Cyberoam This happens if the user has not logged out cleanly from his last Cyberoam session due to network errors This option synchronizes the currentlive user data with the current scenario

547 Repair Summary table Data

Use this option if you are not getting web surfing or internet usage reports This option repairs the summary tables

540 Exit

Type lsquo0rsquo to exit from the Database Utilities Menu and return to Cyberoam Management Menu

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 40: Cyberoam Console Guide

Cyberoam Console Guide

35

55 Download Backup

Use to download backup taken Specify FTP server nameusername and password and the backup file name to be downloaded

56 Restore Backup

Use to restore backup Please note Cyberoam will be rebooted after restoring the backup It is not possible to restore backup of high end appliance on the low end appliance models eg backup of CR500i cannot be restored on CR100i

57 DHCP Client Settings

Use to enable DHCP for a particular interface The configured interface will obtain an IP address automatically from a DHCP server running on the network connected to that interface Configure DHCP client through Network Configuration Wizard from Web Admin Console

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 41: Cyberoam Console Guide

Cyberoam Console Guide

36

58 View Audit Logs

Use to view Audit log This log stores the details of all the actions performed the User administrating Cyberoam Displays operation performed IP address of the User and result of the operation

59 Check and Upgrade New version

Use to check and upgrade to new version

510 Auto Upgrade status

Use to check the auto upgrade status

511 Check and Update Webcat Latest Database

Use to check and upgrade latest webcat database

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 42: Cyberoam Console Guide

Cyberoam Console Guide

37

512 Webcat Auto Upgrade Status

Use to check the auto upgrade status

513 Reset to Factory Defaults

This option resets all the customized configurations to their original state and un-registers Cyberoam All customization done after the initial installation will be deleted including network configuration HTTP proxy cache passwords groups users and policies

514 Custom Menu

Any customized menu option provided especially for the client

515 HA Configuration

Use to bull Disable HA bull Reset HA bull View HA details

5151 Disable HA

HA can be disabled from either of the Appliances HA Administrator will be informed about the status via mail If HA is disabled from primary appliance both the appliances will be in stand-alone mode but primary appliance will process all the traffic If HA is disabled from Auxiliary appliance auxiliary appliance is simply removed from the cluster but primary appliance will still be in ACTIVE mode and process network traffic

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 43: Cyberoam Console Guide

Cyberoam Console Guide

38

5152 Reset HA

After disabling HA to remove Auxiliary appliance from the cluster and use independently reset HA from Auxiliary appliance and change IP schema through Network Configuration Wizard

5153 Show details

Use to view the HA configuration details

5150 Exit

Type lsquo0rsquo to exit from the HA Configuration Menu and return to previous Menu

516 Rollback to previous version

Use to rollback to the previous version of Cyberoam Process will reboot Cyberoam All the configuration changes done after upgrading Cyberoam will be lost ie if you have upgraded from version 953 build 22 to version 958 build 09 and made some configuration changes in version 958 build 09 on rollback configuration done on version 958 build 09 will be lost Cyberoam will rollback to the last configuration of version 953 build 22

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 44: Cyberoam Console Guide

Cyberoam Console Guide

39

517 ReBuild New Firewall State

Whenever firewall does not perform as per the expectation after restarting management service (RMS) you need to rebuild firewall state As it re-applies each firewall rule one-by-one again Cyberoam will take few minutes to be UP again

50 Exit

Type lsquo0rsquo to exit from Cyberoam Management menu and return to Main menu

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 45: Cyberoam Console Guide

Cyberoam Console Guide

40

6 Upgrade version Use to upgrade Cyberoam version Before using this option please check upgrade file is uploaded properly

Some of the common errors

Error message ldquoUpgrade File not found Please upload version File Properlyrdquo ReasonSolution This error may occur if the upgrade file is not uploaded from Cyberoam Web Console Go to Cyberoam Web Console and upload the file again

Error message ldquoSystem requires Restart of Cyberoam Please reboot System before doing

upgraderdquo ReasonSolution This error may occur if system is in inconsistent state reboot the system from Cyberoam CLI Console and try again If still not able to upgrade contact Cyberoam Support

Error messageSolution ldquoCould not extract upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

Error message ldquoCould not find upgrade file Please upload upgrade file properlyrdquo ReasonSolution This error may occur if upgrade file is corrupted download Upgrade file again and repeat the above steps to upgrade

7 Bandwidth Monitor Use to monitor the bandwidth used by each Interface Displays bandwidth used for receiving transmitting and total bandwidth used by each interface

Press lsquoqrsquo or lsquoQrsquo to return to the Main menu

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 46: Cyberoam Console Guide

Cyberoam Console Guide

41

8 VPN Management If Cyberoam is deployed in transparent mode following screen will be displayed

Below given menu will be displayed only when Cyberoam is deployed in Gateway mode

81 Regenerate RSA Key

Use to regenerates the local public key used for authenticating users Public key authentication uses two keys ndash public key available to anyone and a private key held by only one individual The sender encrypts the data with the recipientrsquos public key Only the recipient can decrypt the data being the only one who possesses the corresponding private key RSA key is used for authenticating user when authentication type is defined as lsquoPublic keyrsquo for Net to Net connection Connection type and Authentication type are defined from Web based Administration Console Public key available to all is termed as Local PublicRSA key while private key known to only one individual is termed as Remote Public key Longer the key life larger the risk as it becomes easier to intercept the ciphered text hence it is better to regenerate the RSA key after certain time interval

Once the key is generated it is to be send to all the users

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 47: Cyberoam Console Guide

Cyberoam Console Guide

42

82 Restart VPN service

Use to restart VPN Service

83 View VPN Logs

Use to view VPN logs for troubleshooting

83 View Connection wise VPN Logs

Use to view VPN logs for troubleshooting

84 View Connection wise VPN Logs

Use to view VPN logs Specify the connection name to view specific connection log or press ltEntergt to view logs of all the connections

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 48: Cyberoam Console Guide

Cyberoam Console Guide

43

85 Advance VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

86 PPTP VPN Logs

Use to view date wise connection VPN logs Specify date and connection name to view specific connectionrsquos date wise log

80 Exit

Type lsquo0rsquo to exit from VPN menu and return to the Main menu

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 49: Cyberoam Console Guide

Cyberoam Console Guide

44

9 ShutdownReboot Cyberoam Use to shutdown or reboot Cyberoam

0 Exit Type lsquo0rsquo to exit from Cyberoam Console Management

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 50: Cyberoam Console Guide

Cyberoam Console Guide

45

Annexure A arp Used for debugging purposes to get a complete dump of the ARP cache Syntax arp [ping | proxy | show] Parameter list amp description

Keywords amp Variables Description ping [count | duplicate | interface | silent | source | timeout]

Sends ICMP ECHO_REQUEST packets to network hosts Refer to Ping command for details

proxy [ add [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | delete | [interface (eth0 | lo) | dst_ip ltipaddressgt | dst_iprange (from_ip ltipaddressgt] | to_ip ltipaddressgt ] | show ]

Add and delete proxy ARP

show [ltipaddressgt | interface]

Show manipulate arp cache Refer to Show command for details

clear Clears the screen Syntax clear cyberoam Cyberoam Management Syntax cyberoam [autoupgrade | bandwidth | check_disk | cpu_burn_test | cta | dgd | idp-autoupgrade | repair_disk | restart | services | shutdown | system_monitor | view] Parameter list amp description

Keywords amp Variables Description autoupgrade [show | on | off]

Set whether upgrade can be automatically applied or not show - Displays current status of Autoupgrade mode on - Enables autoupgrade mode Cyberoam will be automatically upgarded incase autoupgrade is available

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 51: Cyberoam Console Guide

Cyberoam Console Guide

46

without any notification or manual intervention off - Disables autoupgrade mode

bandwidth [monitor]

Bandwidth Management Displays bandwidth consumed by all clients

check_disk [data_partition | system_partition]

Displays data and system partition details

cpu_burn_test lt1-60gt Used to test CPU cta [collector add ( collector-ip ltipaddressgt | collector-port ltportgt) | delete ( collector-ip ltipaddressgt | collector-port ltportgt) | disable | enable | show]

Add and remove CTA collector IP address for clientless single sign on configuration

dgd [restart | start | status | stop]

Start and stop dead gateway detection module Supported only when more than one gateway is configured

idp_autoupgrade [show | on | off]

Enable or disable IPS autoupgrade

repair_disk Repair data or system partition of hard disk restart Restart Cyberoam shutdown Shutdown Cyberoam services [restart | status] restart ndash Restarts management services

status ndash Generates systemrsquos current status file with the name cyberoamdebug file File contains details like list of all the processes currently running on the system resource usage etc File is generated on appliance and can be downloaded from ltcyberoam ipaddressgtdocuments

system-monitor [on | off | restart | show ]

Enable or disable system monitor

view [audit-log] View Audit Log disableremote Disables the remote (SSH) connection if enabled By default it is not allowed Refer to enable remote to allow to establish the remote connection Syntax disableremote dnslookup Query Internet domain name servers for hostname resolving Syntax dnslookup host [ltipaddressgt (dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt) | ltstringgt (queryclass ltstringgt | time ltnumbergt) ] | server [- | ltipaddressgt (host) | ltstringgt] Parameter list amp description

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 52: Cyberoam Console Guide

Cyberoam Console Guide

47

Keywords amp Variables Description host [ltipaddressgt [dot_notation_address | queryclass ltstringgt | querytype ltstringgt | time ltnumbergt] | ltstringgt | [queryclass ltstringgt | time ltnumbergt]]

Host to be searched

server [- | ltipaddressgt [host]| ltstringgt]

Internet name or address of the name server

enableremote Allows to connect to the Cyberoam remotely ie allows to establish remote (SSH) connection By default remote connection is not allowed Syntax enableremote [port ltnumbergt | serverip ltipaddressgt] Parameter list amp description

Keywords amp Parameters Description port ltnumbergt Port through which the remote SSH connection

can be established serverip ltipaddressgt IP address of the Cyberoam to which the

remote connection can be established httpclient Client to query cache server using URL as argument ip Utility from iproute2 package Syntax ip [addr | link | maddr | monitor | mroute | neigh | route | rule | tunnel ] Parameter list amp description

Keywords amp Parameters Description addr [add [ ltipaddressgt | dev [ eth0 | lo ] | peer ] | del [ ltipaddressgt | dev | peer ] |

Protocol Address Management Allows to add and delete protocol address dev ndash name of the device peer ltipaddressgt - For Point to Point Interfaces

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 53: Cyberoam Console Guide

Cyberoam Console Guide

48

flush | show]

anycast ltipaddressgt - anycast destinations addresses broadcast ltipaddressgt - Broadcast address on the interface label ltstringgt - Each address may be tagged with a label string scope ltnumbergt - scope of the area where IP address will be valid global - Configured IP address will be valid globally host - Configured IP address will be valid only inside the host link - Link local IP address

flush Flush Protocol addresses deprecated - (IPv6 only) flush deprecated addresses dynamic - flush only those addresses configured in stateless address configuration label - flush addresses with label matching the pattern permanent - flush only permanent addresses primary ndash flush only primary addresses secondary - flush only secondary addresses tentative - flush IP address which did not pass duplicate address detection

show Display Protocol addresses deprecated - (IPv6 only) list deprecated addresses dynamic - List only those addresses configured in stateless address configuration label - List addresses with label matching the pattern permanent - List only permanent addresses primary - List only primary addresses secondary - List only secondary addresses tentative - List IP address which did not pass duplicate address detection

link [set | show] Network device configuration address ltstringgt - Change the Station address of the Interface allmulti [off | on] - Device receives all Multicast packets on the link arp [off | on] - Change the NOARP flag on the Device

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 54: Cyberoam Console Guide

Cyberoam Console Guide

49

broadcast ltstringgt - Change the link layer Broadcast address down - Change the State of Device to DOWN dynamic [off | on] - Flag indicating that Interface is dynamically createddestroyed mtu ltnumbergt - Change the MTU of the Device name lttestgt - Change device name multicast [off | on] - Flag indicating that the Interface is aware of Multicasting promisc [off | on] -Device listens to and feeds to the kernel all traffic on the link txqueuelen ltnumbergt - Transmit Queue Length up - Change the State of Device to UP

maddr [add ltstringgt | dev ] | del ltstringgt | dev ] | show [dev ] ]

Multicast Address Management

monitor [ltstringgt | all] State Monitoring mroute [show [from ltstringgt| interface [eth0 | lo]| to ltstringgt]]

Multicast Routing Cache Management

neigh [add | change | del | flush | replace | show]

NeighbourArp Tables Management lladdr [lttextgt | dev | nud] - lladdr Link Layer Address of neighbour nud [noarp | permanent | reachable | stale] [dev | lladdr] - Neighbour Unreachability Detection change ltipaddressgt - Change an Existing entry del ltipaddressgt - Delete a Neighbour entry replace ltipaddressgt - Add a new entry or Change an existing one

route [add | append | change | del | flush | get | list | replace]

Routing Table Management ltstringgt - Prefix string blackhole - Unreachable destinations broadcast - Destinations are broadcast addresses local - Destinations are assigned to this host multicast ndash Used for mutlicasting routing nat ndash NAT route

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 55: Cyberoam Console Guide

Cyberoam Console Guide

50

prohibit ndash Unreachable destinations throw - Route used with policy rules unicast ndash Route entry describes real paths to the destinations unreachable - Unreachable destinations advmss - Advertise Maximal Segment Size cwnd - Clamp for congestion window dev - The Output Device name equalize - Allow packet by packet randomization on multipath routes metric - Preference value of the Route mtu - Maximal Transfer Unit nexthop -The nexthop of a multipath route onlink - Pretend that nexthop is directly attached to this link pervasive - Pervasive hop realms - Route with this realm rtt - Round Trip Time rttvar - Initial RTT variance estimate ssthresh - Estimate for the initial slow start threshold via - Address of the nexthop router weight - Weight for this element of a multipath route reflecting its quality window - Maximal window for TCP to advertise root - Selects routes with prefixes not shorter than PREFIX match - Selects routes with prefixes not longer than PREFIX exact - Selects routes with exact PREFIX table - Show the routes from this table(s) proto - Only list routes of this protocol type - Only list routes of this type scope - Only list routes with this scope table ndash Show routes for the table

rule [add | del | list]

Routing policy database management from ltstringgt - Source prefix

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 56: Cyberoam Console Guide

Cyberoam Console Guide

51

fwmark ltstringgt - fwmark value nat ltipaddressgt - Base of the IP address block to translate pref ltnumbergt - Rule priority prohibit - Prohibit Communication administratively realms lttextgt - Select realm(s) reject - Bad Path table ltnumbergt - Rules for this table to ltstringgt - Destination prefix tos ltnumbergt - TOS value

tunnel [add | change | del | show]

(IP tunnel devices only) Configure the physical source and destination address for IP tunnel interfaces csum ltinterfacegt - (only GRE tunnels) - generaterequire checksums for tunneled packets dev [eth0 | lo ] - Network device icsum ltinterfacegt -Generaterequire checksums for tunneled packets lkey [ltipaddressgt | ltnumbergt ] -Use keyed GRE with this Input key lseq - Flag enables sequencing of incoming packets key [ltipaddressgt | ltnumbergt ] -(only GRE tunnels) use keyed GRE with key local ltipaddressgt - Set the fixed local address for tunneled packets mode [gre | ipip | sit] - Set the tunnel mode nopmtudisc - Disable Path MTU Discovery on this tunnel ocsum - Generaterequire checksums for tunneled packets okey [ltipaddressgt | ltnumbergt] -Use keyed GRE with this output key oseq - Flag enables sequencing of outgoing packets pmtudisc - Enable Path MTU Discovery on this tunnel remote ltipaddressgt - Set the remote endpoint of the tunnel seq - Flag is equivalent to the combination `iseq oseq tos ltnumbergt - Type of Service ttl ltnumbergt - Time to Live

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 57: Cyberoam Console Guide

Cyberoam Console Guide

52

message Send Message to all the users Syntax Message all-users lttextgt packet-capture Packet capture displays dropped packets details on the specified interface It will provide connection details and details on which module is dropping packets eg firewall IPS along with information like firewall rule number user Internet Access policy number etc This will help Cyberoam administrators to troubleshoot errant firewall rule Syntax packet-capture [lttextgt | interface] Parameter list amp description

Keywords amp Variables Description lttextgt

BPF Compatible Packet filter expression related to IP layer and above Based on the specified filter dropped packets are dumped If no expression is given all the dropped packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

interface Listen on ltinterfacegt BPF (Berkeley Packet Filter) sits between link-level driver and the user space BPF is protocol independent and use a filter-before-buffering approach It includes a machine abstraction to make the filtering efficient

How to view traffic of the packet-capture command Example

specific host packet-capture rsquohost ltipaddressgtrsquo packet-capture lsquohost 1010101rsquo specific source host packet-capture rsquosrc host

ltipaddressgtrsquo packet-capture lsquosrc host 1010101rsquo

specific destination host

packet-capture rsquodst host ltipaddressgtrsquo

packet-capture lsquodst host 1010101rsquo

specific network packet-capture rsquonet ltnetwork addressgtrsquo

packet-capture lsquonet 1010100rsquo

specific source network

packet-capture rsquosrc net ltnetwork addressgtrsquo

packet-capture lsquosrc net 1010100rsquo

specific destination network

packet-capture rsquodst net ltnetwork addressgtrsquo

packet-capture lsquodst net 1010100rsquo

specific port packet-capture rsquoport ltport-numbergtrsquo packet-capture lsquoport 21rsquo

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 58: Cyberoam Console Guide

Cyberoam Console Guide

53

specific source port packet-capture rsquosrc port ltport-numbergtrsquo

packet-capture lsquosrc port 21rsquo

specific destination port

packet-capture rsquodst port ltport-numbergtrsquo

packet-capture lsquodst port 21rsquo

specific host for the particular port

packet-capture lsquohost ltipaddressgt and port ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

packet-capture lsquohost ltipaddressgt and port not ltport-numbergtrsquo

packet-capture lsquohost 1010101 and port not 22rsquo

specific protocol packet-capture rsquoproto ICMPrsquo packet-capture rsquoproto UDPrsquo packet-capture rsquoproto TCPrsquo packet-capture lsquoarprsquo

particular interface packet-capture interface ltinterfacegt packet-capture interface eth1 specific port of a particular interface

packet-capture interface ltinterfacegt lsquoport ltport-numbergtrsquo

packet-capture interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes ping Sends ICMP ECHO_REQUEST packets to network hosts Syntax ping [ltipaddressgt | ltstringgt | count | interface | interval | numeric | quiet | record-route | size | timeout | tos | ttl] Parameter list amp description

Keywords amp Variables Description ipaddress IP address to be pinged string Domain to be pinged count ltnumbergt Stop sending packets after count interface [eth0 | lo]

Set source address

interval ltnumbergt Wait time period in seconds between sending each packet numeric Do not resolve IP address to hostname quiet Display the summary at startup and end record-route Displays the route from response size ltnumbergt Number of data bytes to be sent timeout ltnumbergt Stop sending packets and exit after specified time tos ltnumbergt Set Quality of Service ttl ltcountgt IP Time to Live

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 59: Cyberoam Console Guide

Cyberoam Console Guide

54

route Use to view manipulate the IP routing table Route manipulates the kernelrsquos IP routing tables Its primary use is to set up temporary routes to specific hosts or networks via an interface When the add or del options are used route modifies the routing tables Without these options route displays the current contents of the routing tables Syntax route [add | del | show] Parameter list amp description

Keywords amp Variables Description add [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | mss ltnumbergt | net ltipaddressgt ltnetmaskgt | window ltnumbergt ]

add a new route for host gateway and configure MSS value

del [ltipaddressgt [ltinterfacegt | dev ltinterfacegt | gateway ltipaddressgt | metric ltcountgt] | default [gateway ltipaddressgt ] | host ltipaddressgt | net ltipaddressgt ltnetmaskgt ]

delete route

show displays the routing table Routing table Destination The destination network or destination host Gateway The gateway address or if not set Genmask The netmask for the destination net 255255255255 for a host destination and 0000 for the default route Flags Possible flags include U (route is up) H (target is a host) G (use gateway) R (reinstate route for dynamic routing) D (dynamically installed by daemon or redirect) M (modified from routing daemon or redirect) A (installed by addrconf) C (cache entry) (reject route) Metric The lsquodistancersquo to the target (usually counted in hops) It is not used by recent kernels but may be needed by routing daemons

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 60: Cyberoam Console Guide

Cyberoam Console Guide

55

Ref Number of references to this route (Not used in the Linux kernel) Use Count of lookups for the route Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C) Iface Interface to which packets for this route will be sent set Set entities Syntax set [ advanced-firewall | arp-flux | bandwidth | cache | ha | http_proxy | network | secure_scanning | sslvpn | usermac] Parameter list amp description

Keywords amp Variables Description advanced-firewall [bypass-stateful-firewal-config [add ltdest_host | dest_network | source_host | source_destinationgt | del ltdest_host | dest_network | source_host | source_destinationgt] | fragmented-traffic (allow | deny) | ftpbounce-prevention (control | data) | midstream-connection-pickup (on | off) | strict-icmp-error-tracking (on | off) | strict-policy (on | off) | tcp-est-idle-timeout lt2700 - 43200gt | tcp-seq-checking (on | off)]

Configure advanced firewall setting bypass-stateful-firewal-config ndash Add host or network when the outbound and return traffic does not always traverse through Cyberoam fragmented-traffic - Allow or deny fragmented traffic ftpbounce-prevention - Prevent ftp-bounce attack on FTP control and data connection midstream-connection-pickup - Configure midstream connection pickup settings strict-icmp-error-tracking ndash Configure whether incase of ICMP error existing connection should be deleted from its internal connection state or not strict-policy on - Applies strict firewall policy It drops UDP Dst Port 0 TCP Src Port 0 andor Dst Port 0 Land Attack Winnuke Attack Data On TCP Sync Zero IP Protocol TTL Value 0 traffic strict-policy off - Disables strict firewall policy tcp-est-idle-timeout - Set Idle Timeout between 2700-432000 seconds for TCP connections in the established state tcp-seq-checking ndash Every TCP packet contains a Sequence Number (SYN) and an Acknowledgement Number (ACK) Cyberoam monitors SYN and ACK numbers within a certain window to ensure that

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 61: Cyberoam Console Guide

Cyberoam Console Guide

56

the packet is indeed part of the session But certain application and third party vendors use non-RFC methods to verify a packets validity or for some other reason a server may send packets in invalid sequence numbers and expect an acknowledgement For this reason Cyberoam offers the ability to disable this feature By default this option is ON tcp-window-tracking on - Cyberoam will drop all the packets with invalid sequence number and reduces the window of opportunity for malicious packets to be passed through the Cyberoam tcp-window-tracking off - Cyberoam will allow all the packets with invalid sequence number

arp-flux [ on | off ]

ARP flux occurs when multiple ethernet adaptors often on a single machine respond to an ARP query Due to this problem with the link layer address to IP address mapping can occur Cyberoam may respond to ARP requests from both Ethernet interfaces On the machine creating the ARP request these multiple answers can cause confusion ARP flux affects only when Cyberoam has multiple physical connections to the same medium or broadcast domain on - Cyberoam may respond to ARP requests from both Ethernet interfaces when Cyberoam has multiple physical connections to the same medium or broadcast domain off - Cyberoam responds to ARP requests from respective Ethernet interface when Cyberoam has multiple physical connections to the same medium or broadcast domain

bandwidth [ default-policy (guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergt | graph | guarantee (enforced | lenient) | max-limit ltnumbergt]

default-policy and guarantee allows to define the bandwidth restriction on the traffic on which the bandwidth policy is not applied while max-limit allows to define the link bandwidth

bull To set the link bandwidth ie bandwidth provided by Service Provider and can be used as ldquoset bandwidth max-limit ltnumbergtrdquo and to view the configured limit use the command ldquoshow bandwidth max-limitrdquo Default=100mbps

bull To enforce bandwidth restriction on the traffic on which the bandwidth policy is not applied so that guaranteed bandwidth is available to the users to whom the guaranteed bandwidth policy is applied configure ldquoset bandwidth guarantee enforcedrdquo

bull If guarantee is enforced default bandwidth

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 62: Cyberoam Console Guide

Cyberoam Console Guide

57

policy will be applicable to the traffic on which bandwidth policy is not applied You can set the guaranteed and burstable bandwidth and priority on this traffic This bandwidth is applicable on Internal (LAN and DMZ) to External zone (WAN and VPN) traffic and External to Internal zone traffic Default Guaranteed bandwidth = 0 kbps Burstable bandwidth = max-limit priority = 7 (lowest) Guaranteed and burstable bandwidth can be defined as ldquoset bandwidth default-policy guaranteed ltnumbergt burstable ltnumbergt priority ltnumbergtrdquo

bull If you do not want to enforce the bandwidth restriction on the traffic on which the bandwidth policy is not applied configure ldquoset bandwidth guarantee lenientrdquo

graph - Opens the Bandwidth Graph Management menu and allows to flush the generated graphs

cache [clean]

Set Cache Properties Removes all Cached files

ha [appliance-model-check (on | off) | load-balancing (on | off) ]

appliance-model-check ndash Checks both the appliance models before configuring HA will be configured only if both the models are same Default - on load-balancing - Enable or disable load balancing for HA cluster

http_proxy [av_sessions ltintegergt | client_sessions ltintegergt | core_dump (on | off) | debug (on | off)| deny_unknown_proto (yes | no) | host-entries (add lthost-namegt | delete lthost-namegt) relay_http_invalid_traffic | rw_buffer_size ltintegergt| x_forwarded_for (on | off)]

Set proxy parameters av_sessions ndash no of files to be scanned simultaneously Default ndash 20 Range ndash 1- 64 client_session ndash no of simultaneous client session Default ndash 1024 Range ndash 1024 ndash 8192 One may need to increase when DNS server is responding slowly or number of simultaneous requests are high core_dump ndash generate dump Default - OFF debug - Generate http proxy debug log As it is resource consuming process ON only when required Execute lsquoshow http log debugrsquo to view log deny_unknown_proto ndash allow or deny traffic not following HTTPS protocol ie invalid traffic through HTTPS port Default - Yes host-entries ndash add or remove the static DNS entry for http proxy traffic If the entry is found DNS request will not be forwarded to root server or configured DNS server

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 63: Cyberoam Console Guide

Cyberoam Console Guide

58

relay_invalid_http_traffic - allow or deny traffic not following HTTP protocol ie invalid traffic through HTTP port Default ndash No rw_buffer_size ndash size of readwrite buffer Default - 4 Kbytes Range 1 to 16 Kbytes One can increase in-case of high speed WAN link x_forwarded_for ndash IncludeExclude X-Forwarded-For header information from outbound HTTP requests Default - OFF Applicable only in when Cyberoam is deployed transparent mode

network [interface-speed [port lt1000fd | 1000hd | 100fd | 100hd | 10fd | 10hd | auto gt] | mss [port ltnumber | defaultgt] | mtu [port ltnumbergt]]

Configure network interface parameters interface speed - Speed mismatch between Cyberoam and 3rd party routers and switches can result into errors or collisions on interface no connection or traffic latency slow performance mss ndash Maximum Segment Size ndash It defines the amount of data that can be transmitted in a single TCP packet Range ndash 576 ndash 1460 bytes mtu - Maximum Transmission Unit - It specifies the largest physical packet size in bytes that a network can transmit This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent Default ndash 1500 bytes MTU size is based on addressing mode of the interface Range ndash 576 ndash 1500 bytes for static mode Range ndash 576 ndash 1500 bytes for DHCP mode Range ndash 576 ndash 1492 bytes for PPPoE mode

secure-scanning HTTPS (on | off) Enable or disable HTTPS scanning globally ie entire HTTPS traffic is scanned if enabled By default it is enabled (on) HTTPS scanning is enabled only the specific policy when enabled through Internet Access Policy (IAP) from Web Admin Console Cyberoam will not scan HTTPS traffic if enabled from IAP but is disabled (off) globally

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 64: Cyberoam Console Guide

Cyberoam Console Guide

59

sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

gateway-mode ndash Control Cyberoam being as a default routing gateway Default ndash on Set to ldquoOFFrdquo when appliance is not used as a default routing gateway for the internal resources (hostsnetworks) max-clients - Control maximum simultaneous requests handled by the web access mode max-connections - Control concurrent number of users that can access via SSL VPN owa-basic-mode - Control enforcement of Outlook Web Access basic mode Default ndash off Set to ldquoONrdquo to enforce Outlook Web Access Basic mode web-access - Startstop web access service Default - on

usermac (on | off) Enable or disable MAC binding If enabled user will be able to logon and use the Internet from configured computer only and not from any other machine After enabling configure MAC addresses for user from Web Admin Console Default - off One needs to restart management services after enabling or disabling the binding

show Shows various system modules information Syntax show [ access-log | advanced-firewall | antispam | antivirus | bandwidth | date | firewall-rule-log | ftp | ha | http_proxy | login | mail | monitor | network | pppoe | reboot | secure_scanning | sslvpn | system | vpn ] Parameter list amp description

Keywords amp Variables Description access-log Displays IP addresses of machines from where Cyberoam

was (attempt-)accessed advanced-firewall Displays advanced firewall configuration strict Policy

ftpbounce prevention tcp connection establishment Idle timeout fragmented traffic policy midstream connection pickup TCP seq checking strict ICMP error tracking

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 65: Cyberoam Console Guide

Cyberoam Console Guide

60

configuration bypass stateful firewall If strict policy is ON Cyberoam drops UDP packets with destination port 0 TCP packets with source and destination port 0 land attack winnuke attack TCP Syn Packets containing data IP Packet with Protocol Number 0 and IP Packet with TTL Value 0 traffic

antispam [ log ]

Displays antispam log

antivirus [ log ]

Displays antivirus log

bandwidth [default-policy | guarantee | max-limit | total-guaranteed-bw ]

Displays default policy configuration whether guaranteed bandwidth is enforced or lenient and maximum bandwidth limit In the total-guaranteed-bw the sum of the applied guaranteed bandwidth is displayed which should be less than max-limit

date Displays system Time amp Date firewall-rule-log Displays firewall rule log ndash rules which are not applied

successfully ftp [log linesltnumbergt ]

Displays ftp log

ha [log lines ltnumbergt ]

Displays HA log if high availability is enabled

http_proxy [ config | host-entries | log [access | all | debug | error ] | version ]

Displays http proxy version IP address wise logs can also be viewed

login Displays who iswas logged on mail [ livelog | log | queue]

Information about mail subsystem

monitor [log lines ltnumbergt ]

Displays ftp log

network [ bandwidth | connections | interface-speed | interfaces [all] | mss | mtu]

Show network connections from system network interface information interface speed mtu and mss settings

pppoe Displays PPPoE connection status reboot Show system reboot history sslvpn [gateway-mode (on | off) | max-clients ltnumbergt | max-connections ltnumbergt | owa-basic-mode (on | off) | web-access(on | off)]

Displays sslvpn settings

system [ cpu | devices | disk | dma | filesystems | interrupts | iomem | ioports | logs | memory | messages | modules | partitions | pci | processes | publickey | statistics | uptime ]

Information about system hardware resources and softwares cpu - Displays cpu information like processor vendor model model name speed cache size devices - Displays list of System Devices disk - Displays the records of disk space used Also displays distribution of disk space used and unused disk space by the various file systems on a volume

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 66: Cyberoam Console Guide

Cyberoam Console Guide

61

dma - Displays DMA information filesystems - Displays filesystem supported interrupts - Displays System Interrupts information iomem - Displays IO and Memory information Ioports - Displays IO Ports information logs - Displays PPPoE logs memory - Display system memory status messages - Use to examine or control the kernel ring buffer Helps to print bootup messages used for debug modules - Displays list of loaded modules partitions - Displays Partition information pci - Displays Peripherals information processes - Displays Process Tree publickey - Displays public key of the appliance statistics - Displays reports about processes memory paging block IO traps and cpu activity uptime - Tell how long the system has been running

vpn [connection status]

Displays VPN connection status

tcpdump tcpdump prints out the headers of packets on a network interface that match the boolean expression Only packets that match expression will be processed by tcpdump Syntax tcpdump [lttextgt | count | filedump | hex | interface | llh | no_time | quite | verbose ] Parameter list amp description

Keywords amp Variables Description lttextgt

Packet filter expression Based on the specified filter packets are dumped If no expression is given all packets are dumped else only packets for which expression is `true are dumped The expression consists of one or more primitives Primitives usually consist of an id (name or number) proceeded by one or more qualifiers Refer to the below given table on writing filtering expressions

count Exit after receiving count packets filedump Tcpdump output can be generated based on criteria required

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 67: Cyberoam Console Guide

Cyberoam Console Guide

62

Save tcpdump output in a binary file and can be downloaded from httpltcyberooam_ipgtdocumentstcpdumpout File contains the troubleshooting information useful to analyze the traffic with advanced tool like ethereal for Cyberoam Support team

hex Print each packet (minus its link level header) in hexadecimal notation

interface Listen on ltinterfacegt llh View packet contents with Ethernet or other layer 2 header

information no_time Do not print a timestamp on each dump line quite Print less protocol information so output lines are shorter verbose Verbose output For example the time to live identification

total length and options in an IP packet are printed Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum

How to view traffic of the tcpdump command Example

specific host tcpdump rsquohost ltipaddressgtrsquo tcpdump lsquohost 1010101rsquo specific source host

tcpdump rsquosrc host ltipaddressgtrsquo tcpdump lsquosrc host 1010101rsquo

specific destination host

tcpdump rsquodst host ltipaddressgtrsquo tcpdump lsquodst host 1010101rsquo

specific network tcpdump rsquonet ltnetwork addressgtrsquo tcpdump lsquonet 1010100rsquo specific source network

tcpdump rsquosrc net ltnetwork addressgtrsquo

tcpdump lsquosrc net 1010100rsquo

specific destination network

tcpdump rsquodst net ltnetwork addressgtrsquo

tcpdump lsquodst net 1010100rsquo

specific port tcpdump rsquoport ltport-numbergtrsquo tcpdump lsquoport 21rsquo specific source port tcpdump rsquosrc port ltport-numbergtrsquo tcpdump lsquosrc port 21rsquo specific destination port

tcpdump rsquodst port ltport-numbergtrsquo tcpdump lsquodst port 21rsquo

specific host for the particular port

tcpdump lsquohost ltipaddressgt and port ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port 21rsquo

the specific host for all the ports except SSH

tcpdump lsquohost ltipaddressgt and port not ltport-numbergtrsquo

tcpdump lsquohost 1010101 and port not 22rsquo

specific protocol tcpdump rsquoproto ICMPrsquo tcpdump rsquoproto UDPrsquo tcpdump rsquoproto TCPrsquo tcpdump lsquoarprsquo

paritcular interface tcpdump interface ltinterfacegt tcpdump interface eth1 specific port of a particular interface

tcpdump interface ltinterfacegt lsquoport ltport-numbergtrsquo

tcpdump interface eth1 lsquoport 21rsquo

Note Expression can be combined using logical operators AND or OR and with NOT also Make sure to use different combinations within single quotes

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 68: Cyberoam Console Guide

Cyberoam Console Guide

63

telnet Use telnet protocol to connect to another remote computer Syntax telnet [ltipaddressgt | source | tos] Parameter list amp description

Keywords amp Variables Description ipaddress ltportgt

official name an alias or the Internet address of a remote host Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

source [ ltipaddressgt | ltipaddressgt ]

Use given IP address as source address Port - indicates a port number (address of an application) If a number is not specified the default telnet port is used

tos [ltnumbergt | ltipaddressgt | ltportgt ]

IP type-of-service option for the connection

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 69: Cyberoam Console Guide

Cyberoam Console Guide

64

traceroute Use to trace the path taken by a packet from the source system to the destination system over the Internet The Internet is a large and complex aggregation of network hardware connected together by gateways Tracking the route ones packets follow (or finding the miscreant gateway that is discarding your packets) can be difficult Traceroute utilizes the IP protocol `time to live field and attempts to elicit an ICMP TIME_EXCEEDED response from each gateway along the path to some host Syntax traceroute [ ltipaddressgt | ltstringgt | base-port ltportgt | first-ttl | icmp | max-ttl | no-frag | probes | source | timeout | tos]

Keywords amp Variables Description ltipaddressgt [size ltnumbergt]

Set the IP address to be traced

ltstringgt [size ltnumbergt]

Set the domain to be traced

base-port Set the base UDP port number used in probes -default 33434

first-ttl Set the initial time-to-live used in the first outgoing probe packet

icmp Use ICMP ECHO instead of UDP datagrams max-ttl Set the max time-to-live no-frag Set the dont fragment bit probes Probes are sent at each ttl -default 3 source Use given IP address as source address timeout Set the timeout -in seconds for a response to a probe -

default 5 tos Set the type-of-service

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1
Page 70: Cyberoam Console Guide

Cyberoam Console Guide

65

Change Log

Revision Topic Description 10 Initial Release with following changes in the previous

version guide Menu 515 Logging

Management Menu 516 Restore Backup of Version 72

Removed

Console Command - set

Removed - set http_proxy dns_threads and set date as the Cyberoam no longer supports this feature

Console Command ndash cyberoam

Added ndash cta dgd

Console Command - set

Added ndash ha sslvpn and usermac

Console Command - show

Added - sslvpn

20 Console Command - set

Added ndash host-entries in http_proxy command bandwidth

Console Command - show

Added - host-entries in http_proxy command bandwidth

  • Contents
  • Annexure I - Contents
  • Preface
    • Guide Audience
    • Technical Support
    • Typographic Conventions
      • Introduction
        • Notation conventions
          • Introduction
          • Accessing Cyberoam CLI Console
            • Accessing CLI Console via remote login utility - TELNET
            • Accessing CLI Console using SSH client
              • R Restart Management Services
              • 1 Network configuration
                • For Gateway mode
                • For Transparent (bridge) mode
                  • 11 IP address configuration
                  • 12 Add Alias
                  • 13 Remove Alias
                  • 14 Remove All Alias
                  • 15 VLAN Management
                  • 151 Add VLAN ID
                  • 152 Remove VLAN ID
                  • 153 Show VLAN ID Configuration
                  • 150 Exit
                    • 10 Exit
                      • 2 System configuration
                        • 21 Set Console Password
                        • 22 Set System Date
                        • 23 View Access logs
                        • 24 Set Cyberoam Administrator Email ID
                        • 25 Traceroute Utility
                        • 26 Set Module Info
                        • 27 Bandwidth Graph Setting
                          • 271 Flush Gateway Graphs
                          • 272 Flush System Health Graphs
                          • 273 Flush All Bandwidth Graphs
                          • 270 Exit
                            • 28 EnableDisable LAN Bypass
                            • 20 Exit
                              • 3 Route configuration
                                • 31 Configure Unicast Routing
                                  • 311 Configure Static-routesACLs
                                  • 312 Configure RIP
                                  • 313 Configure OSPF
                                  • 313 Configure Border Gateway Protocol (BGP)
                                  • 310 Exit
                                    • 32 Configure Multicast Routing
                                      • 321 EnableDisable Multicast forwarding
                                      • 322 Configure Static multicast routes
                                      • 320 Exit
                                        • 30 Exit
                                          • 4 Cyberoam Console
                                          • 5 Cyberoam Management
                                            • 51 Restart Management Services
                                            • 52 Remove Firewall Rules
                                            • 53 Reset Management Password
                                            • 54 Database Utilities
                                              • 541 Database Quick Repair
                                              • 542 Database Full Repair
                                              • 543 Repair Web Surfing logs
                                              • 544 Repair User Session logs
                                              • 545 Repair Live User Data
                                              • 546 Synchronize Live User Data
                                              • 547 Repair Summary table Data
                                              • 540 Exit
                                                • 55 Download Backup
                                                • 56 Restore Backup
                                                • 57 DHCP Client Settings
                                                • 58 View Audit Logs
                                                • 59 Check and Upgrade New version
                                                • 510 Auto Upgrade status
                                                • 511 Check and Update Webcat Latest Database
                                                • 512 Webcat Auto Upgrade Status
                                                • 513 Reset to Factory Defaults
                                                • 514 Custom Menu
                                                • 515 HA Configuration
                                                  • 5151 Disable HA
                                                  • 5152 Reset HA
                                                  • 5153 Show details
                                                  • 5150 Exit
                                                    • 516 Rollback to previous version
                                                    • 517 ReBuild New Firewall State
                                                    • 50 Exit
                                                      • 6 Upgrade version
                                                      • 7 Bandwidth Monitor
                                                      • 8 VPN Management
                                                        • 81 Regenerate RSA Key
                                                        • 82 Restart VPN service
                                                        • 83 View VPN Logs
                                                        • 83 View Connection wise VPN Logs
                                                        • 84 View Connection wise VPN Logs
                                                        • 85 Advance VPN Logs
                                                        • 86 PPTP VPN Logs
                                                        • 80 Exit
                                                          • 9 ShutdownReboot Cyberoam
                                                          • 0 Exit
                                                          • Annexure A
                                                            • Change Log
                                                              • Word Bookmarks
                                                                • wp1000881
                                                                • wp1005920
                                                                • works
                                                                • wp1000885
                                                                • wp1020565
                                                                • wp1020566
                                                                • wp1020567
                                                                • wp1020726
                                                                • OLE_LINK1