Nortel SMC 2450 Command Reference Manual

Command Reference Document Number: NN10300-091 Document Release: Standard 1.00 Date: May 2006 Year Publish FCC TM Copyright © 2006 Nortel Networks. All rights reserved. Produced in Canada The information in this document is subject to change without notice. The statements, configurations, technical data, and recommendations in this document are believed to be accurate and reliable, but are presented without express or implied warranty. Users must take full responsibility for their applications of any products specified in this document. The information in this document is proprietary to Nortel Networks. Nortel, Nortel (Logo), the Globemark, SL-1, Meridian 1, and Succession are trademarks of Nortel Networks. Title page

Secure Multimedia Controller Command Reference 4 Revision history May 2006 Standard 1.00. This document is a new NTP. It was created to support the Secure Multimedia Controller 2450.

Secure Multimedia Controller Command Reference 8 Contents About this document . . . . . . . . . . . . . . . . . . . . . . . 9 Subject .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Applicable systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Intended audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Conventions .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Related information .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 How to get help . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Getting help from the Nortel web site .. . . . . . . . . . . . . . . . . . . . . . . . . 13 Getting help over the telephone from a Nortel Solutions Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Getting help from a specialist by using an Express Routing Code . . . . 14 Getting help through a Nortel distributor or reseller .. . . . . . . . . . . . . . 14 Main menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Information menu . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Info_host menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Information_net menu .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Route Information menu .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 VRRP Information menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Administration Information menu .. . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Statistics Information menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Contents NN10300-091 Standard 1.00 May 2006 Configuration menu . . . . . . . . . . . . . . . . . . . . . . . . 29 System menu .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Date and Time menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 DNS Servers menu .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Cluster menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Access List menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Administrative Applications menu . . . . . . . . . . . . . . . . . . . . . . . . . 41 Platform Logging menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 User menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Network Configuration menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Port menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Interface menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Routes menu .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 VRRP Settings menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Proxy ARP menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Multimedia Security menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Security Zone menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Inbound Access menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Flow Control menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Outbound Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 SMC Settings menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 UNIStim Security menu .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 SMC Network menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Service menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Boot menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Software Management menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Software Patches menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Maintenance menu . . . . . . . . . . . . . . . . . . . . . . . . . 117 Tech Support Dump menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 UNIStim Flow Maintenance menu .. . . . . . . . . . . . . . . . . . . . . . . . . . . 118 UNIStim Connection Rate menu . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 UNIStim Packet Rate menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 UNIStim Bandwidth Rate menu . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Secure Multimedia Controller Command Reference Appendix A: Selected firewall attacks . . . . . . . . . . 121 SYN flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Source routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Mime flood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 FTP bounce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 IP unaligned timestamp .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Sequence number prediction .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Sequence number out of range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 ICMP redirect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 IP spoofing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Ping of death . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Land attacks .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 IP reassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Appendix B: Firewall limits . . . . . . . . . . . . . . . . . . 125

Secure Multimedia Controller Command Reference 12 About this document This document is a global document. Contact your system supplier or your Nortel representative to verify that the hardware and software described are supported in your area. Subject This document describes Secure Multimedia Controller (SMC) 2450 system architecture, software and hardware requirements, components, and network connections. Note legacy products and releases This Nortel Technical Publication (NTP) contains information about systems, components, and features that are compatible with Nortel Communication Server 1000 Release 4.5 and Nortel Multimedia Communication Server 5100 software. For more information about legacy products and releases, click the Technical Documentation link under Support & Training on the Nortel home page: www.nortel.com Applicable systems This document applies to the following systems: • Communication Server 1000E (CS 1000E) • Communication Server 1000S (CS 1000S) • Communication Server 1000M Chassis (CS 1000M Chassis)

About this document NN10300-091 Standard 1.00 May 2006 • Communication Server 1000M Cabinet (CS 1000M Cabinet) • Communication Server 1000M Half Group (CS 1000M HG) • Communication Server 1000M Single Group (CS 1000M SG) • Communication Server 1000M Multi Group (CS 1000M MG) • Multimedia Communication Server 5100 Server Micro System (V100) • Multimedia Communication Server 5100 Server Simplex System (V100) • Multimedia Communication Server 5100 Server Redundant System (V100) • Multimedia Communication Server 5100 Server Large System (N240) For more information, see the following: • Communication Server 1000S: Upgrade Procedures (553-3031-258) • Communication Server 1000E: Upgrade Procedures (553-3041-258) Intended audience This document is intended for individuals responsible for installation, configuration, administration, and maintenance of the SMC 2450. Conventions Terminology In this document, the following systems are referred to generically as system: • Communication Server 1000E (CS 1000E) • Communication Server 1000S (CS 1000S) • Communication Server 1000M (CS 1000M) • Meridian 1 The following systems are referred to generically as Small System: • Communication Server 1000M Chassis (CS 1000M Chassis) • Communication Server 1000M Cabinet (CS 1000M Cabinet)

Page 11 of 126 Secure Multimedia Controller Command Reference • Meridian 1 PBX 11C Chassis • Meridian 1 PBX 11C Cabinet The following systems are referred to generically as Large System: • Communication Server 1000M Half Group (CS 1000M HG) • Communication Server 1000M Single Group (CS 1000M SG) • Communication Server 1000M Multi Group (CS 1000M MG) • Meridian 1 PBX 51C • Meridian 1 PBX 61C • Meridian 1 PBX 61C CP PII • Meridian 1 PBX 81 • Meridian 1 PBX 81C • Meridian 1 PBX 81C CP PII Related information This section lists information sources that relate to this document. NTPs The following NTPs are referenced in this document: • Secure Multimedia Controller: Implemention guide (553-3001-225) • Secure Multimedia Controller: Planning and engineering guide (NN42320-200) Online To access Nortel documentation online, click the Technical Documentation link under Support & Training on the Nortel home page: www.nortel.com

About this document NN10300-091 Standard 1.00 May 2006 CD-ROM To obtain Nortel documentation on CD-ROM, contact your Nortel customer representative.

Secure Multimedia Controller Command Reference 14 How to get help This chapter explains how to get help for Nortel products and services. Getting help from the Nortel web site The best way to get technical support for Nortel products is from the Nortel Technical Support web site: www.nortel.com/support This site provides quick access to software, documentation, bulletins, and tools to address issues with Nortel products. From this site, you can: • download software, documentation, and product bulletins • search the Technical Support web site and the Nortel Knowledge Base for answers to technical issues • sign up for automatic notification of new software and documentation for Nortel equipment • open and manage technical support cases Getting help over the telephone from a Nortel Solutions Center If you do not find the information you require on the Nortel Technical Support web site, and you have a Nortel support contract, you can also get help over the telephone from a Nortel Solutions Center. In North America, call 1-800-4NORTEL (1-800-466-7835).

How to get help NN10300-091 Standard 1.00 May 2006 Outside North America, go to the following web site to obtain the telephone number for your region: www.nortel.com/callus Getting help from a specialist by using an Express Routing Code To access some Nortel Technical Solutions Centers, you can use an Express Routing Code (ERC) to quickly route your call to a specialist in your Nortel product or service. To locate the ERC for your product or service, go to: www.nortel.com/erc Getting help through a Nortel distributor or reseller If you purchased a service contract for your Nortel product from a distributor or authorized reseller, contact the technical support staff for that distributor or reseller.

Secure Multimedia Controller Command Reference 18 Main menu After you complete the initial Secure Multimedia Controller (SMC) system setup and perform a successful connection and logon, the Main menu of the command line interface (CLI) appears. For more information about the CLI and how to use it, see Secure Multimedia Controller: Implemention guide (553-3001-225). Table 1 identifies and describes the Main menu commands. Table 1 Main menu commands Command Description info Displays information about the current status of the SMCs. For menu items, see “Information menu” on page 19. cfg Displays the Configuration menu, which you can use to configure the SMCs. Some commands in the Configuration menu are available for only the administrator user account. For menu items, see “Configuration menu” on page 29. boot Displays the Boot menu, which you can use to upgrade the SMC software and reboot, if necessary. Only the administrator user account can access the Boot menu. For menu items, see “Boot menu” on page 113. maint Displays the Maintenance menu, which you can use to send dump files and log details to the servers. For menu items, see “Maintenance menu” on page 117.

Main menu NN10300-091 Standard 1.00 May 2006 diff Displays the pending configuration changes. Only pending changes made during your current administrator session are included. Pending changes made by other CLI or browser-based interface (BBI) administrator sessions are not included. validate Validates pending configuration changes made during your current administration session. This command does not include pending changes made by other CLI or BBI administrator sessions. When you enter the Validate command, your pending changes are validated to ensure that they are complete and consistent. If problems exist, warning or error messages are displayed. • Warnings identify conditions that require special attention, but that do not cause errors or prevent the configuration when you enter the Apply command. • Errors identify serious configuration problems that you must correct before you apply the changes. Uncorrected errors cause the Apply command to fail. If the Validate command returns warning or error messages, heed the messages and make any necessary configuration changes. security Lists the status (enabled or disabled) for remote management features such as Telnet, SSH, and BBI. The Security command also displays a list of users still using default passwords that should be changed. Table 1 Main menu commands Command Description

Secure Multimedia Controller Command Reference apply Applies and saves configuration changes made during your current administration session. Changes are considered pending and do not take effect until you issue the Apply command. Pending changes made by other CLI or BBI administrator sessions are not affected. When issued, the Apply command first validates your session’s pending changes. If problems exist, applicable warning and error messages are displayed. • Warnings identify conditions that require special attention, but that do not cause errors or prevent the configuration when you enter the Apply command. • Errors identify serious configuration problems that you must correct before you apply the changes. Uncorrected errors cause the Apply command to fail. If no errors exist, the changes are saved and put into effect. If multiple CLI or BBI administrators apply changes to the same set of parameters concurrently, the latest applied changes take precedence. revert Cancels all pending configuration changes made during your current administration session. The revert command does not affect: • applied changes • pending changes made by other CLI or BBI sessions Table 1 Main menu commands Command Description

Main menu NN10300-091 Standard 1.00 May 2006 paste [] Restores a saved configuration dump file that includes encrypted private keys. When you create a configuration dump using the Dump command, you create a password to decrypt the private keys. When you enter the Paste command, you are prompted to supply the password. The password phrase remains in effect until cleared. Note: To clear the password phrase, enter the Paste command again. You can then open the configuration dump file in your text editor, copy the information, and paste it to the CLI window. After you paste the information, the SMC batch processes the configuration content. The pasted configuration enters as a pending configuration, and any included private keys are decrypted. You can use the global Diff command to view the pending configuration changes. To apply the pending configuration changes, use the global Apply command. help [] Provides brief information about the specified command. When used without a parameter, the Help command displays a list of global commands. exit Logs off the current session and exits the CLI. Pending changes made during your current session are lost if not applied. This command does not affect other open CLI or BBI sessions. Table 1 Main menu commands Command Description

Secure Multimedia Controller Command Reference 28 Information menu The Information menu (/info) provides access to information about the current status of the SMC. Table 2 identifies and describes the Information menu commands. Table 2 Information menu (/info) Command Description summary Displays runtime information for the host SMC. The runtime information includes the host IP address, the host type, whether the host owns the cluster Management IP (MIP) address, CPU usage, memory usage, and operational status. clu Displays runtime information for all SMCs in the cluster. The runtime information includes: • CPU usage • hard disk usage • status of important applications such as Web server, SNMP, and Internet server • secure UNIStim proxy and firewall information

Information menu NN10300-091 Standard 1.00 May 2006 host Displays runtime information for the specified SMC host. The runtime information includes: • CPU usage • hard disk usage • status of important applications such as Web server, SNMP, and Internet server • secure UNIStim proxy and firewall information For menu items, see “Info_host menu” on page 22. net Displays the current network configuration. This information is the same information that the /cfg/net/cur command provides. For menu items, see “Information_net menu” on page 23. admin Provides access to administration menu items, such as accesslist, Telnet, SSH, Web, and UPS configurations. For menu items, see “Administration Information menu” on page 25. log Displays configuration and UNIStim log archiving information, including the e-mail address to which the SMC can send the log files upon log rotation. stats Displays the Statistics menu. For menu items, see “Statistics Information menu” on page 26. ethereal Displays the text-based interface of ethereal, which provides information about the traffic log. It also can dump the output to the console, a USB memory stick, or a remote device using the ftp/sftp/scp/tftp command. sensor Displays the current status of hardware parameters such as temperature and fan rotation per minute (RPM) status. The sensor module generates alarm events when the fan RPM values reach the critical level or when the temperature reaches the maximum level. Table 2 Information menu (/info) Command Description

Secure Multimedia Controller Command Reference about Displays system information such as the product type and version of the running build. alarms Lists the alarms generated in the system. dump Displays the current configuration information available in the Information menu. Table 2 Information menu (/info) Command Description

Information menu NN10300-091 Standard 1.00 May 2006 Info_host menu The Info_host menu (/info/host) provides configuration, status, and statistics information about the host runtime, link, Ethernet, and syslog parameters. Table 3 identifies and describes the Info_host menu commands. Table 3 Info_host menu (/info/host) Command Description status Displays the runtime and application status for the specified host. link Displays the status information for all network interface ports. The auto-negotiate status and link status (Up or Down) are always displayed. If the link status is UP, the port speed and the duplex mode are also displayed. ether Displays the statistics of all interfaces configured in the cluster. The statistics are Rx Count, Tx Count, Rx Bytes, Tx Bytes, and so on. syslog Displays the last 100 syslog messages. After each set of 10 syslog messages is displayed, you are prompted to continue the display (y) or exit (n). fwlog Displays the last 100 fwlog messages. After each set of 10 fwlog messages is displayed, you are prompted to continue the display (y) or exit (n). usecplog Displays the last 100 usecplog messages. After each set of 10 usecplog messages is displayed, you are prompted to continue the display (y) or exit (n).

Secure Multimedia Controller Command Reference Information_net menu The Information_net menu (/info/net) shows the interface, route, and VRRP details. Table 4 identifies and describes the Info_net menu commands. Route Information menu The Route Information menu (/info/net/route) provides access to information about static routes. Table 5 identifies and describes the Route Information menu commands. Table 4(( Info_net menu (/info/net) Command Description if Displays the interface details such as the ID, IP address and netmask, port assignment, operational status, and Virtual LAN (VLAN) number. arp Displays the ARP entries in the cluster. gw Displays the default gateway configured in the cluster. route Displays the Route Information menu. For menu items, see “Route Information menu” on page 23. vrrp Displays the VRRP Information menu, which displays Virtual Router Redundancy Protocol (VRRP) configuration and status information. For menu items, see “VRRP Information menu” on page 24. Table 5 Route Information menu (/info/net/route) Command Description static Displays all static routes configured on the system.

Information menu NN10300-091 Standard 1.00 May 2006 VRRP Information menu The VRRP Information menu (/info/net/vrrp) provides access to information about the status and configuration of VRRP. Table 6 identifies and describes the VRRP Information menu commands. Table 6 VRRP Information menu (/info/net/vrrp) Command Description status Displays the status for the VRRP Virtual Router ID (vrid). cfg Displays the VRRP settings such as high availability (HA), VRRP advertisement interval, gratuitous ARP (GARP) delay interval, GARP broadcast interval, Advanced Failover Check (AFC), and Preferred Master details.

Secure Multimedia Controller Command Reference Administration Information menu The Administration menu (/info/admin) provides access to information about accesslist, Telnet, SSH, Web, and UPS configurations. Table 7 identifies and describes the Administration Information menu commands. Table 7 Administration Information menu (/info/admin) Command Description accesslist Displays the access rights configured for the cluster and displays the list of enabled networks accessing the SMC cluster from the remote sites. telnet Displays the current Telnet configuration settings: enabled or disabled. ssh Displays the current SSH configuration settings: enabled or disabled. web Displays the current BBI configuration settings such as status (enabled or disabled), service port number for HTTP and HTTPS, and certificate information for Secure Sockets Layer (SSL).

Information menu NN10300-091 Standard 1.00 May 2006 Statistics Information menu The Statistics Information menu (/info/stats) provides access to information about SMC statistics. Table 8 identifies and describes the Statistics Information menu commands. Table 8 Statistics Information menu (/info/stats) Command Description fwattack Displays historical statistics for approximately 130 firewall attacks against which the SMC provides protection. Only attacks within the previous day are listed. For each type of attack, this command displays a count of how many times it occurred in the current hour, the past hour, and the past day. If no attacks occurred, the list is empty. fwsession Displays a list of current sessions in use on the SMC. The list entry for each session contains the source IP, destination IP, the protocol, the destination port, and the number of bytes transferred.

Secure Multimedia Controller Command Reference fwpolicy Lists the number of times a firewall policy was successfully matched for a stream of traffic and the number of times a match was not made. The statistics for the current hour, past hour, and day total are displayed. unistim Displays relevant statistics for the UNIStim servers: • server statistics: total number of servers configured on SMC • client statistics: — number of secure clients currently connected through the SMC — number of non-secure clients currently connected through the SMC — cumulative number of secure clients connected through SMC from when the SMC was started until present — cumulative non-secure clients connected through SMC from when the SMC was started until present • policy statistics: — number of times the Allow Policy is triggered for the secure or non-secure clients — number of times the Switch Policy is triggered for the clients to force non-secure clients to reconnect in secure mode — number of times the Deny Policy is triggered for the secure or non-secure clients • errors: — number of invalid or out of sequence packets arrived from the server causing the SMC to send a NAK to the server — number of errors on the Secure UNIStim proxy due to lack of resources — number of invalid or out of sequence packets arrived from the client causing the SMC to send a negative acknowledgement (NAK) to the client — number of packets that are not in the expected state causing a bad transition in the state machine of UsecProxy — number of clients that come in as secure but have an invalid fingerprint of the SMC Public Key — Number of clients that are deleted as a result of too many server retransmissions Table 8 Statistics Information menu (/info/stats) Command Description

Secure Multimedia Controller Command Reference 112 Configuration menu Using the Configuration menu (/cfg), you can configure the SMC. Some commands are available only from the administrator logon. Table 9 identifies and describes the Configuration menu commands. Table 9 Configuration menu (/cfg) Command Description sys Displays the System menu, which you can use to configure system-wide parameters. For menu items, see “System menu” on page 32. net Displays the Network Configuration menu, which you can use to configure the networks passing traffic through the SMC. For menu items, see “Network Configuration menu” on page 72. smc Displays the Multimedia Security menu, which you can use to configure multimedia security on the SMC. For menu items, see “Multimedia Security menu” on page 81.

Configuration menu NN10300-091 Standard 1.00 May 2006 ptcfg Saves the current configuration, including private keys and certificates, to a file on the selected server. The information is saved in a plain-text file, and you can later restore the configuration by using the gtcfg command. The supported servers are: • SCP • SFTP • TFTP • FTP The SCP and SFTP protocols are secure and encrypted. TFTP and FTP are encrypted. When saving a configuration to a secure server, you are prompted to specify a password. Table 9 Configuration menu (/cfg) Command Description

Secure Multimedia Controller Command Reference gtcfg Retrieves and applies the configuration file, including private keys and certificates, from the selected server. If the server is secure, such as the SCP and SFTP servers, you are prompted to enter the same password phrase supplied when the file was created using the ptcfg command. You must reboot the SMC after restoring a configuration using the gtcfg command. dump Displays the current configuration parameters in CLI compatible format. You can copy and save the configuration information to a text editor file by performing a copy-and-paste operation. To view the pending configuration changes resulting from the batch processing, use the Diff command. To apply the configuration changes, use the Apply command. If you choose to include private keys in the configuration dump, you are required to specify a password phrase. The password phrase enables encryption. When restoring a configuration that includes secret information, use the global Paste command. Before pasting the configuration, you are prompted to reenter the password phrase. Table 9 Configuration menu (/cfg) Command Description

Configuration menu NN10300-091 Standard 1.00 May 2006 System menu Using the System menu (/cfg/sys), you can configure system-wide parameters. Table 10 identifies and describes the System menu commands. Table 10 System menu (/cfg/sys) Command Description time Configures the date, time, time zone, and Network Time Protocol (NTP). For menu items, see “Date and Time menu” on page 33. dns Changes Domain Name System (DNS) parameters. For menu items, see “DNS Servers menu” on page 35. cluster Displays the Host Information menu, which you can use to configure the host IP address and cluster management IP (MIP) address for the SMC host. You can also assign a physical port to the SMC host. For menu items, see “Cluster menu” on page 36. accesslist Displays the Access List menu, which you can use to restrict remote access to SMC management features. You can add, delete, or list trusted IP addresses that are allowed Telnet, Secure Shell (SSH), or Browser-Based Interface (BBI) access to the SMC. For menu items, see “Access List menu” on page 39. adm Displays the Administrative Application menu, which you can use to configure idle timeout and SMC remote management features such as Telnet, SSH, SNMP, and BBI. For menu items, see “Administrative Applications menu” on page 41.

Secure Multimedia Controller Command Reference Date and Time menu Using the Date and Time menu (/cfg/sys/time), you can configure the system date, time, and time zone options. Table 11 identifies and describes the Date and Time menu commands. log Displays the Platform Logging menu, which you can use to configure system message logging features. Messages can be logged to the system console terminal and archived to a file for automatic e-mailing. For menu items, see “Platform Logging menu” on page 60. user Displays the User menu, which you can use to add, modify, delete, or list SMC user accounts and change passwords. For menu items, see “User menu” on page 68. Table 11 Date and Time menu (/cfg/sys/time) Command Description date Sets the system date according to the specified format. time Sets the system time using a 24-hour clock format. Nortel recommends that you reboot the SMC after entering a time change that is greater than 1 minute. tzone Sets the system time zone. When entered without a parameter, you are prompted to select your time zone from a list of continents/oceans, countries, and regions. ntp Displays the NTP menu, which you can use to synchronize system time with Network Time Protocol (NTP) servers. For menu items, see “NTP menu” on page 34. Table 10 System menu (/cfg/sys) Command Description

Configuration menu NN10300-091 Standard 1.00 May 2006 NTP menu Using the NTP menu (/cfg/sys/time/ntp), you can add or delete Network Time Protocol (NTP) servers that synchronize system time. Table 12 identifies and describes the NTP menu commands. Table 12 NTP menu (/cfg/sys/time/ntp) Command Description list Lists all configured NTP servers by their index number and IP address. del Removes an NTP server from the configuration by specifying the server index number. Use the List command to display the index numbers and IP addresses of configured NTP servers. add Adds an NTP server to the list of NTP servers, which are used to synchronize the SMC system clock. Add at least three NTP servers to compensate for any discrepancies among the servers.

Secure Multimedia Controller Command Reference DNS Servers menu Using the DNS Servers menu (/cfg/sys/dns), you can change Domain Name System (DNS) parameters. Table 13 identifies and describes the DNS Servers menu commands. Table 13 DNS Servers menu (/cfg/sys/dns) Command Description list Displays all DNS servers by their index number and IP address. del Removes a DNS server by index number. If required, use the List command to display the index numbers and IP addresses of added DNS servers. add Adds a new DNS server. insert Adds a new DNS server to the list at the specified index position. All existing items at the specified index number and higher are incremented by one position. move Removes the DNS server from the specified index number and inserts it at the specified index number.

Configuration menu NN10300-091 Standard 1.00 May 2006 Cluster menu Using the Cluster menu (/cfg/sys/cluster), you can configure the SMC host IP address and cluster Management IP (MIP) address. Table 14 identifies and describes the Cluster menu commands. Table 14 Cluster menu (/cfg/sys/cluster) Command Description mip Specifies the Cluster Management IP (MIP) address. The cluster MIP address must be unique. Assign a cluster MIP address that resides on the same subnet as the SMC host IP. The cluster MIP address supports clustered SMCs in a high availability (HA) configuration; however, you must configure the cluster MIP address even if you do not have an HA configuration. host Provides access to the Cluster Host menu for the specified host. For menu items, see “Cluster Host menu” on page 37.

Secure Multimedia Controller Command Reference Cluster Host menu Using the Cluster Host menu (/cfg/sys/cluster/host), you can change parameters for the SMC host. To identify the host number, use the /cfg/sys/cluster/cur command. Table 15 identifies and describes the Cluster Host menu commands. Table 15 Cluster Host menu (/cfg/sys/cluster/host ) Command Description ip Specifies the IP address of the selected host. Changing this address does not affect the cluster MIP address that defines the cluster. After you apply the new IP address using the Apply command, the system logs you off. name Specifies a name for each SMC. When you log on as the administrator, the name of the SMC appears as part of the banner. licence Allows you to enter a Secure UNIStim license into the SMC cluster. The license parameter determines how many Secure UNIStim users are supported by the SMC. The license is associated with the MAC address of port 1 on the SMC. To enter a license, follow the prompts and paste the license string directly into the CLI. When complete, press to go to a new line and then type three periods (...) to terminate the command sequence. The license will be automatically stored on the particular SMC. In an HA cluster, two licenses are required to support secure UNIStim: one on each SMC in the cluster. Note 1: The license restriction applies only to secure UNIStim users. Note 2: Type cur within the Cluster Host screen to see the current license for the SMC.

Configuration menu NN10300-091 Standard 1.00 May 2006 mac Displays the MAC address of port 1 on the SMC host. This MAC address is used to generate the secure UNIStim license for that particular device. To increase the number of secure UNIStim users in an SMC cluster, you need to access the MAC address of each SMC device using this command and send the MAC address back to Nortel for license generation. hwplatform Displays the hardware platform model number. halt [y | n] Stops the selected host. Always use this command only before turning off the device. If the host is isolated from the cluster, you receive an error message when performing the Halt command. You must log on log on to the host using either its local serial port or through remote access to the host IP address before you use the Halt command in the boot menu. See “halt” on page 113. Table 15 Cluster Host menu (/cfg/sys/cluster/host ) Command Description

Secure Multimedia Controller Command Reference Access List menu Administrators can manage the SMC remotely using Telnet, SSH, or the BBI and acquire various status parameters using SNMP. For security purposes, access to these features is restricted to authorized clients through the access list. Using the access list menu (/cfg/sys/accesslist), you can specify IP addresses or address ranges that are permitted remote access to the system. There is only one access list, which applies to all remote management features. By default, the management network is added to the access list. reboot [y | n] Reboots the selected host. If the host is isolated from the cluster, you receive an error message when performing the Reboot command. You must log on log on to the host using either its local serial port or through remote access to the host IP address before you use the Reboot command in the boot menu. See “reboot” on page 113. delete Removes the selected host from the cluster and resets the removed host to its factory default configuration. The other host in the cluster is unaffected. To ensure that you removed the intended host, view the current settings using the Cur command. To view the host number, type, and IP address for both hosts in a cluster, use the /cfg/sys/cluster/cur command string. After you remove a host from the cluster using the Delete command, you can access the device only through a console terminal connected to its local serial port. You can log on using the administration account (admin) and the default password (admin) to access the Setup menu. When two hosts are present in a cluster, you cannot delete a particular host if it is the only host with a health status of Up. In this case, you receive an error message when performing the Delete command. Table 15 Cluster Host menu (/cfg/sys/cluster/host ) Command Description

Configuration menu NN10300-091 Standard 1.00 May 2006 Requests for remote management access from any client whose IP address is not on the access list are dropped. You can ping the SMC host from an IP address not listed in the access list. When you add a client IP address to the access list, that client can access all enabled remote management features. Table 16 identifies and describes the Access List menu commands. Table 16 Access List menu (/cfg/sys/accesslist) Command Description list Displays index and IP address information for the trusted clients that can access enabled remote management features. del Removes the specified access list entry by index number. add Adds the specified IP address or range of addresses to the access list.

Secure Multimedia Controller Command Reference Administrative Applications menu Using the Administrative Applications menu (/cfg/sys/adm), you can enable the SMC remote management features such as Telnet, SSH, SNMP, and the BBI. Table 17 identifies and describes the Administrative Application menu commands. Table 17 Administrative Application menu (/cfg/sys/adm) Command Description idle Specifies the amount of time, in terms of seconds, that a CLI or BBI session can remain inactive before automatically logging off. The default value is 300 seconds, which equates to 10 minutes. The maximum is 604800. If a user makes changes to the SMC configuration and the CLI or BBI times out before the user applies them, all changes are lost. telnet Enables or disables Telnet sessions for remote access to the SMC management CLI. For menu items, see “Telnet Administration menu” on page 42. You need to add an entry into the access list for the client before it can administer the SMC through Telnet. See “Access List menu” on page 39. ssh Enables or disables Secure Shell (SSH) for remote access to the SMC management CLI. You can also generate SSH host keys. For menu items, see “SSH Administration menu” on page 43. You need to add an entry into the access list for the client before it can administer the SMC through SSH. See “Access List menu” on page 39.

Configuration menu NN10300-091 Standard 1.00 May 2006 Telnet Administration menu Using the Telnet Administration menu (/cfg/sys/adm/telnet), you can enable or disable remote Telnet access to the SMC CLI. By default, Telnet access is disabled. Note: Telnet is not a secure protocol. All data (including the password) between a Telnet client and the SMC is unencrypted and unauthenticated. Depending on the severity of your security policy, you can enable Telnet access and restrict it to one or more trusted clients. web Configures the Browser-Based Interface (BBI). The BBI provides HTTP or Secure Sockets Layer (SSL) access for remote management of the SMC using a Web browser. For menu items, see “Web Administration menu” on page 45. You need to add an entry into the access list for the client before it can administer the SMC through the BBI. See “Access List menu” on page 39. snmp Controls Simple Network Management Protocol (SNMP) read access and enables or disables SNMP event and alarm messages for the SMC. You can also define SNMP information, permission levels, and traps. For menu items, see “SNMP Administration menu” on page 50. You need to add an entry into the access list for the client before it can issue requests to the SMC through SNMP. See “Access List menu” on page 39. audit Configures the servers to receive log messages on the commands executed in the CLI and the Web user interface (UI). For menu items, see “Audit menu” on page 56. auth Configures RADIUS authentication. For menu items, see “Authentication menu” on page 59. Table 17 Administrative Application menu (/cfg/sys/adm) Command Description

Secure Multimedia Controller Command Reference Table 18 identifies and describes the Telnet Administration menu commands. SSH Administration menu Using the SSH Administration menu (/cfg/sys/adm/ssh), you can enable or disable Secure Shell (SSH) for remote access to the SMC management CLI. You can also generate SSH host keys. An SSH connection enables secure management of the SMC from any workstation connected to the network. SSH access provides server host authentication, encryption of management messages, and encryption of passwords for user authentication. By default, SSH is disabled. Table 18 Telnet Administration menu (/cfg/sys/adm/telnet) Command Description ena Enables the Telnet management feature. When enabled, trusted clients on the access list can access the host IP address through Telnet. dis Disables the Telnet management feature. When disabled, all active Telnet administration sessions are terminated, and all Telnet requests sent to the host IP address are dropped. The SMC uses iptables to implement access control to its management interfaces (SSH, Telnet, HTTP, and HTTPS). Iptables inspect packets above SMC-1 in the TCP/IP stack. The SMC can limit external access to internal system management software that uses sockets to communicate.

Configuration menu NN10300-091 Standard 1.00 May 2006 Table 19 identifies and describes the SSH Administration menu commands. SSH Host Keys menu Using the SSH Host Keys menu (/cfg/sys/adm/ssh/sshkeys), you can generate and manage SSH host keys. Table 20 identifies and describes the SSH Administration menu commands. Table 19 SSH Administration menu (/cfg/sys/adm/ssh) Command Description ena Enables the SSH management feature. When enabled, trusted clients on the access list can access the host IP address through SSH. dis Disables the SSH management feature. When disabled, all active SSH administration sessions are terminated, and all SSH requests sent to the host IP address are dropped. sshkeys Configures and manages SSH host keys. For menu items, see “SSH Host Keys menu” on page 44. Table 20 SSH Administration menu (/cfg/sys/adm/ssh/sshkeys) Command Description generate Generates new SSH host keys. show Displays a list of current SSH host keys for the cluster. knownhosts Manages SSH host keys of remote hosts. For menu items, see “SSH Known Host Keys menu” on page 45.

Secure Multimedia Controller Command Reference SSH Known Host Keys menu Using the SSH Known Host Keys menu (/cfg/sys/adm/ssh/sshkeys/ knownhosts), you can manage SSH host keys of remote hosts. Table 21 identifies and describes the SSH Administration menu commands. Web Administration menu Using the Web Administration menu (/cfg/sys/adm/web), you can configure the Browser-Based Interface (BBI). The BBI is a remote management tool, which you can use to access the SMC using a Web browser. You can configure the BBI to use HTTP (non-secure), HTTPS with Secure Sockets Layer (SSL), or both. Table 22 identifies and describes the Web Administration menu commands. Table 21 SSH Administration menu (/cfg/sys/adm/ssh/sshkeys/knownhosts) Command Description list Lists known SSH keys of remote hosts. del Deletes SSH host key by index values. add Adds a new SSH host key. import Retrieves SSH keys of remote hosts. Table 22 Web Administration menu (/cfg/sys/adm/web) Command Description http Configures BBI access using HTTP (non-secure). For menu items, see “HTTP Configuration menu” on page 46. ssl Configures BBI access using HTTPS with Secure Sockets Layer (SSL). For security reasons, Nortel recommends that you use SSL with the BBI. For menu items, see “SSL Configuration menu” on page 46.

Configuration menu NN10300-091 Standard 1.00 May 2006 HTTP Configuration menu Using the HTTP Configuration menu (/cfg/sys/adm/web/http), you can configure BBI access using HTTP. By default, HTTP access is enabled, but restricted to trusted clients. Depending on the severity of your security policy, you can disable HTTP access and refine the list of trusted clients. Note: HTTP is not a secure protocol. All data (including passwords) between an HTTP client and the SMC is unencrypted and unauthenticated. If secure remote access is required, see the “SSL Configuration menu” on page 46. Table 23 identifies and describes the HTTP Configuration menu commands. SSL Configuration menu Using the SSL Configuration menu (/cfg/sys/adm/web/ssl), you can configure BBI access using HTTPS. HTTPS uses Secure Sockets Layer (SSL) to provide server host authentication, encryption of management messages, and encryption of passwords for user authentication. For security reasons, Nortel recommends that you use SSL with the BBI. By default, SSL is disabled. Table 23 HTTP Configuration menu (/cfg/sys/adm/web/http) Command Description port Specifies the logical HTTP port used by the built-in BBI Web server. By default, the Web server uses HTTP port 80. You can specify any port number except ports used by other services. ena Enables HTTP access to the BBI. When enabled, trusted clients on the access list can access the host IP address through HTTP. See “Access List menu” on page 39. dis Disables HTTP access to the BBI. When disabled, HTTP requests to the host IP address are dropped.

Secure Multimedia Controller Command Reference In addition to enabling and disabling the HTTPS feature, you can configure the HTTPS port, SSL version, and access menus for generating SSL certificates. Table 24 identifies and describes the SSL Configuration menu commands. Table 24 SSL Configuration menu (/cfg/sys/adm/web/ssl) Command Description port Specifies the logical HTTPS port for the built-in BBI Web server. By default, the Web server uses HTTPS port 443. You can specify any port number except ports used by other services. ena Enables HTTPS access to the BBI. When enabled, trusted clients on the access list can access the host IP address through HTTPS. See “Access List menu” on page 39. You must generate an SSL certificate using the Certificate Management menu to use HTTPS functions. See “Certificate Management menu” on page 48. dis Disables HTTPS access to the BBI. When disabled, HTTPS requests to the host IP address are dropped. tls y | n Enables or disables Transport Level Security (TLS) for SSL. sslv2 y | n Enables or disables SSL Version 2. sslv3 y | n Enables or disables SSL Version 3. certs Configures server certificates and external Certificate Authority certificates required for SSL. See “Certificate Management menu” on page 48 for menu items.

Configuration menu NN10300-091 Standard 1.00 May 2006 Certificate Management menu Using the Certificate Management menu (/cfg/sys/adm/web/ssl/certs), you can add or remove server certificates and external Certificate Authority (CA) certificates required for SSL. Table 25 identifies and describes the Certificate Management menu commands. Table 25 Certificate Management menu (/cfg/sys/adm/web/ssl/certs) Command Description serv Generates a certificate request or creates a self-signed certificate. For menu items, see “Server Certificate Management menu” on page 49. ca Provides management functions for intermediate CA certificates. CA certificate management is a required task if server certificates from external CAs are used. For menu items, see “CA Certificate Management menu” on page 50.

Secure Multimedia Controller Command Reference Server Certificate Management menu Using the Server Certificate Management menu (/cfg/sys/adm/web/ssl/certs/ serv), you can administer SSL server certificates. Table 26 identifies and describes the Server Certificate Management menu commands. Table 26 Server Certificate Management menu (/cfg/sys/adm/web/ssl/certs/serv) Command Description gen Generates a certificate request or a self-signed certificates. exp Exports certificate requests to an external Certificate Authority (CA). This command produces output that you can copy and paste into a text file and then send to the CA for authorization. Do not use this command if to create a self-signed certificate. After the CA responds with a Privacy Enhanced Mail (PEM) certificate, use the Add command to enter the certificate into the system. list Displays a list of configured server certificates. del Deletes a server certificate. add Adds a signed server certificate. After you enter this command, the system expects you to paste the PEM certificate into the CLI. When you finish pasting the certificate, add three periods (...) and press to return to the CLI.

Configuration menu NN10300-091 Standard 1.00 May 2006 CA Certificate Management menu Using the CA Certificate Management menu (/cfg/sys/adm/web/ssl/certs/ca), you can administer SSL external CA certificates. Table 27 identifies and describes the CA Certificate Management menu commands. SNMP Administration menu The SMC software supports elements of the Simple Network Management Protocol (SNMP). If you are running an SNMP network management station on your network, you can read SMC configuration information and statistics using the following SNMP Managed Information Bases (MIBs): • MIB II (RFC 1213) • SMC private MIBs You can access private MIBs using the cluster MIP address. The information is the same regardless of which SMC device in a cluster is accessed. This is not the case for the MIB-II information because the information is specific to the accessed SMC. Table 27 CA Certificate Management menu (/cfg/sys/adm/web/ssl/certs/ca) Command Description list Lists all configured CA certificates. del Removes a CA certificate from the configuration. add Adds an intermediate CA certificate. After you enter this command, the system expects you to paste the PEM certificate into the CLI. When you finish pasting the certificate, add three periods (...) and press to return to the CLI.

Secure Multimedia Controller Command Reference Table 28 identifies and describes the SNMP Administration menu commands. Table 28 SNMP Administration menu (/cfg/sys/adm/snmp) Command Description ena Enables SNMP features. dis Disables SNMP features. model v1 | v2c | usm Specifies the form of SNMP security: • v1: SNMP version 1 • v2c: SNMP version 2C security model • usm: SNMP version 3 User-based Security Model (USM) level auth | priv Specifies the desired degree of SNMP USM security: • none: no security. • auth: Verify the SNMP user password before granting SNMP access. SNMP information is transmitted in plain text. • priv: Verify the SNMP user password before granting SNMP access and encrypt all SNMP information with the user’s individual key. Use this command when usm is selected using the Model command. USM user names, along with their passwords and encryption keys, are defined in the SNMP Users menu (/cfg/sys/adm/snmp/users) on page 52. access d | r Enables or disables access for the read community. events y | n Enables or disables the automatic delivery of event messages to the SNMP trap hosts. When enabled, messages regarding general occurrences, such as detection of new components, are sent. alarms y | n Enables or disables the automatic delivery of alarm messages to the SNMP trap hosts. Alarm messages indicate serious conditions that can require administrative action.

Configuration menu NN10300-091 Standard 1.00 May 2006 SNMP Users menu Using the SNMP Users menu (/cfg/sys/adm/snmp/users), you can list, add, and remove USM users. When usm is selected as the security model (/cfg/sys/ adm/snmp/model), SNMP access is granted only for user/password combinations defined both in this menu and in the Access List menu. See “Access List menu” on page 39. rcomm Displays the current read community value. You can change the value. There is no restriction on the input string. The default read community value is Public. users Displays the SNMP Users menu, which you can use to list, add, and remove USM users. When usm is selected as the security model, SNMP access is granted only for the user/password combination that is defined in both the SNMP Users menu and in the Access List menu. For menu items, see “SNMP Users menu” on page 52. hosts Displays the Trap Hosts menu, which you can use to add, remove, or list hosts that receive event or alarm messages. For menu items, see “Trap Hosts menu” on page 54. system Displays the SNMP System Information menu, which you can use to configure basic identification information such as support contact name, system name, and system location. For menu items, see “SNMP System Information menu” on page 55. adv Displays the Advanced SNMP Settings menu, which you can use to configure advanced SNMP options. For menu items, see “Advanced SNMP Settings menu” on page 56. Table 28 SNMP Administration menu (/cfg/sys/adm/snmp) Command Description

Secure Multimedia Controller Command Reference Table 29 identifies and describes the SNMP Users menu commands. Table 29 SNMP Users menu (/cfg/sys/adm/snmp/users) Command Description list Lists all configured USM users. del Removes a USM user from the configuration. add Adds a USM user. You are prompted to enter the following: • get and/or trap: Specify whether the user is authorized to perform SNMP get requests, receive enabled trap event and alarm messages, or both. • authorization password (and confirmation): Specify the password the user must enter for access. • encryption string (and confirmation): If the level priv option is selected on the SNMP Administration menu (/cfg/sys/adm/snmp), you can encode SNMP traffic between the user and the SMC using the encryption string.

Configuration menu NN10300-091 Standard 1.00 May 2006 Trap Hosts menu Using the Trap Hosts menu (/cfg/sys/adm/snmp/hosts), you can add, remove, or list hosts that receive SNMP event or alarm messages from the SMC cluster. Table 30 identifies and describes the Trap Hosts menu commands. Table 30 Trap Hosts menu (/cfg/sys/adm/snmp/hosts) Command Description list Lists all configured trap hosts that receive SNMP event or alarm messages from the SMC cluster. del Removes an SNMP trap host from the cluster configuration by specifying the trap host index number. Use the List command to display the index numbers and IP addresses of configured trap hosts. add Adds an SNMP trap host. The trap host with the specified IP address receives any enabled SNMP messages from the SMC. You are prompted to enter a port number, community string, and trap user information. You can independently enable or disable event messages and alarm messages in the SNMP Administration menu. See “SNMP Administration menu” on page 50. insert Adds a new trap host IP address to the access list at the specified index position. All existing items at the specified index number and higher are incremented by one position. move Removes the trap host IP address at the specified from index number and inserts it at the specified to index number in the access list.

Secure Multimedia Controller Command Reference SNMP System Information menu Using the SNMP System Information menu (/cfg/sys/adm/snmp/system), you can configure basic identification information such as support contact name, system name, and system location. Table 31 identifies and describes the SNMP System Information menu commands. Table 31 SNMP System Information menu Command Description contact Configures the name of the system contact. The contact can have a maximum of 64 characters. name Configures the name for the system. The name can have a maximum of 64 characters. loc Configures the name of the system location. The location can have a maximum of 64 characters.

Configuration menu NN10300-091 Standard 1.00 May 2006 Advanced SNMP Settings menu Using the Advanced SNMP Settings menu (/cfg/sys/adm/snmp/adv), you can configure advanced SNMP options. Table 32 identifies and describes the Advanced SNMP Settings menu commands. Audit menu Using the Audit menu (/cfg/sys/adm/audit), you can configure a RADIUS server to receive log messages about commands executed in the CLI or the BBI. If auditing is enabled but no RADIUS server is configured, events still generate to the event log and any configured firewall logs. Auditing is disabled by default. An event is generated whenever a user logs on, logs off, or issues a command from a CLI session. The event contains information about the user name, the session ID, and the name of executed commands. This event is optionally sent to a RADIUS server for audit trail logging according to RFC 2866 (RADIUS Accounting). Table 32 Advanced SNMP Settings menu Command Description trapsrcip auto | unique | mip Configures the source IP address for SNMP traps generated from the SMC: • auto: The IP address of the outgoing interface. This is the default IP address. • unique: The IP address of the individual SMC. • mip: The IP address of the cluster MIP. Note: The MIP setting is useful with applications that expect devices to be limited to only one IP address.

Secure Multimedia Controller Command Reference Table 33 identifies and describes the Audit menu commands. Table 33 Audit menu (/cfg/sys/adm/audit) Command Description servers Displays the RADIUS Audit Servers menu. For menu items, see “RADIUS Audit Servers menu” on page 58. vendorid Assigns the SMI Network Management Private Enterprise Code (as defined by IANA in the file http://www.iana.org/assignments/ enterprise-number) to the following vendor specific attribute: Vendor-Id. The Vendor-Id (represented by the private enterprise number) is one of the RADIUS vendor-specific attributes. The default vendor-Id is 1872 (Nortel). Note: If your RADIUS system uses another Vendor-ID, you can use the Vendorid command to bring the RADIUS configuration in line with the value used by the remote RADIUS system. Contact your RADIUS system administrator for more information. vendortype Assigns a number to the following vendor-specific attribute used in RADIUS: Vendor type. Used in combination with the Vendor-Id number, the vendor type number identifies the audit attribute that contains the audit information. The default vendor type value is 2. Note 3: To find audit entries in the RADIUS server log, define a suitable string in the RADIUS server dictionary (for example, Nortel-SMC-Audit-Trail) and map this string to the vendor type value. Note 4: If your RADIUS system uses another number for vendor type, you can use the Vendortype command to bring the RADIUS configuration in line with the value used by the remote RADIUS system. Contact your RADIUS system administrator for more information.

Configuration menu NN10300-091 Standard 1.00 May 2006 RADIUS Audit Servers menu Using the RADIUS Audit Servers menu (/cfg/sys/adm/audit/servers), you can add, modify, and delete information about RADIUS audit servers. Table 34 identifies and describes the Radius Audit Servers menu commands. ena Enables the RADIUS server. dis Disables the RADIUS server. Table 34 Radius Audit Servers menu (/cfg/sys/adm/audit/servers) Command Description list Lists the IP addresses and index numbers of configured RADIUS audit servers. del Removes the specified RADIUS audit server from the configuration. add Adds a RADIUS audit server to the configuration. Specify the IP address, a TCP port number, and the shared secret. The next available index number is automatically assigned by the system. For backup purposes, you can add several RADIUS audit servers. The SMC contacts the server with the lowest index number first. If the SMC cannot contact the server, the SMC tries to contact the server with the next index number in sequence, and so on. Note: The default port number used for RADIUS audit is 1813. Table 33 Audit menu (/cfg/sys/adm/audit) Command Description

Secure Multimedia Controller Command Reference Authentication menu Using the Authentication menu (/cfg/sys/adm/auth), you can configure RADIUS authentication. Table 35 identifies and describes the Authenticating menu commands. RADIUS Authentication Servers menu Using the RADIUS Authentication Servers menu (/cfg/sys/adm/auth/ servers), you can add, modify, and delete information about RADIUS authentication servers. insert Adds a RADIUS audit server and assigns the specified index number to it. RADIUS audit servers have their current index number incremented by one under the following condition: the index number is higher than the one you specify. The shared secret refers to the RADIUS server password. move Moves a RADIUS audit server up or down in the list of configured servers. To view all servers currently added to the configuration, use the List command. Table 35 Authentication menu (/cfg/sys/adm/auth) Command Description servers Displays the RADIUS Authentication Servers menu. For menu items, see “RADIUS Authentication Servers menu” on page 59. timeout Specifies a timeout period for the RADIUS server. fallback Enables the local password as fallback. ena Enables RADIUS authentication. dis Disables RADIUS authentication. Table 34 Radius Audit Servers menu (/cfg/sys/adm/audit/servers) Command Description

Configuration menu NN10300-091 Standard 1.00 May 2006 Table 36 identifies and describes the Radius Authentication Servers menu commands. Platform Logging menu Using the Platform Logging menu (/cfg/sys/log), you can configure system message logging features. Messages can be logged to the system console Table 36 Radius Authentication Servers menu (/cfg/sys/adm/auth/servers) Command Description list Lists the IP addresses and index numbers of configured RADIUS authentication servers. del Removes the specified RADIUS authentication server from the configuration. add Adds a RADIUS authentication server to the configuration. Specify the IP address, a TCP port number, and the shared secret. The next available index number is automatically assigned by the system. For backup purposes, you can add several RADIUS authentication servers. The SMC contacts the server with the lowest index number first. If the SMC cannot contact the server, the SMC tries to contact the server with the next index number in sequence, and so on. Note: The default port number used for RADIUS authentication is 1813. insert Adds a RADIUS audit server and assigns the specified index number to it. RADIUS audit servers have their current index number incremented by one under the following condition: the index number is higher than the one you specify. The shared secret refers to the RADIUS server password. move Moves a RADIUS authentication server up or down in the list of configured servers. To view all servers currently added to the configuration, use the List command.

Secure Multimedia Controller Command Reference terminal and archived to a file that can be automatically e-mailed to an administrator for debugging. Table 37 identifies and describes the Platform Logging menu commands. IMPORTANT! Too many firewall logs can affect SMC performance. Nortel recommends you update the firewall log configuration to prevent this degradation in performance. For more information, see Secure Multimedia Controller: Planning and engineering (NN42320-200). Table 37 Platform Logging menu (/cfg/sys/log) Command Description syslog Displays the remote syslog menu, which you can use to configure the system log (syslog) servers. After configuration, the SMC software can send log messages to specified syslog hosts. For menu items, see “System Logging menu” on page 62. firewall Displays the Remote Firewall Log menu, which you can use to remotely send firewall logs to an external system log server using the standard remote syslog port. Note: You can limit the logs by configuring firewall logging options in the Message Logging menu. See “Message Logging menu” on page 90. arch Displays the Log Archiving menu, which you can use to archive log files after the file reaches a specific size or age. When log rotation occurs, the current log file is stored or e-mailed to a specified address and a new log file is created. For menu items, see “Log Archiving menu” on page 64.

Configuration menu NN10300-091 Standard 1.00 May 2006 System Logging menu Using the System Logging menu (/cfg/sys/log/syslog), you can configure the firewall logs. After configuration, the SMC software can send log messages to specified syslog hosts. Table 38 identifies and describes the System Logging menu commands. debug y | n Enables or disables specialized debugging log messages. By default, this setting is disabled. Enable it only as directed by Nortel technical support. sourceip auto | uniqe | mip Specifies the source IP address for logs generated from the SMC. • auto: the IP address of the outgoing interface. • unique: the IP address of the individual SMC. • mip: the IP address of the cluster MIP. The mip setting is useful with applications, such as HP OpenView, that expect devices to be limited to only one IP address. Table 38 System Logging menu (/cfg/sys/log/syslog) Command Description list Displays all configured firewall logs by their index number, IP address, and facility number. del Removes the specified firewall log from the cluster configuration. add Adds a new firewall log, including its IP address and local facility number. The local facility number uniquely identifies syslog entries. Table 37 Platform Logging menu (/cfg/sys/log) Command Description

Secure Multimedia Controller Command Reference insert Adds a new firewall log to the list at the specified index position. All existing items at the specified index number and higher are incremented by one position. move Removes the firewall log from the specified index number and inserts it at the specified index number. Table 38 System Logging menu (/cfg/sys/log/syslog) Command Description

Configuration menu NN10300-091 Standard 1.00 May 2006 Firewall Log menu Using the Firewall Log menu (cfg/sys/log/firewall), you can remotely send firewall logs to an external system log server using the standard remote syslog port. Table 39 identifies and describes the Firewall Log menu commands. Log Archiving menu Using the Log Archiving menu (/cfg/sys/log/arch), you can archive log files when the files reach a specific size or age. When log rotation occurs, the current log file is stored or e-mailed to a specified address and a new log file is created. If the rotate size is set above 0, log rotation occurs when the log surpasses the rotate size, or when the log rotation interval is reached, whichever occurs first. If the rotate size is set to 0, the file size is ignored and only the rotate interval is used. If an e-mail address and SMTP server IP address are configured, the log file is e-mailed when rotated. Using the Log Archive menu, you can archive three primary types of logs available in the SMC: • syslog • firewall • UNIStim Each of these are treated separately in the log archiving menu. Table 39 Firewall Log menu Command Description addr Specifies the firewall log address. del Removes the firewall log.

Secure Multimedia Controller Command Reference Table 41 identifies and describes the Log Archiving menu commands. Table 40 Log Archiving menu Command Description syslog Displays the System Log menu, which you can use to configure system log parameters. For menu items, see “System Log menu” on page 66. firewall Displays the Firewall Log menu, which you can use to configure firewall log parameters. For menu items, see “Firewall Log menu” on page 66. unistim Displays the UNIStim Log menu, which you can use to configure UNIStim log parameters. For menu items, see “UNIStim Log menu” on page 67.

Configuration menu NN10300-091 Standard 1.00 May 2006 System Log menu Using the System Log menu (/cfg/sys/log/arch/syslog), you can configure system log parameters. The system logs contain information and errors generated during standard system operation. Table 41 identifies and describes the System Log menu commands. Firewall Log menu Using the Firewall Log menu (/cfg/sys/log/arch/firewall), you can configure firewall log parameters. The firewall log contains all logging related to the firewall operation. The log includes details on attacks and basic firewall operation, if configured. The messages sent to the firewall logs are defined in the Platform Logging menu (smc/settings/log/). You can also specify firewall logging for individual packets that traverse the SMC by enabling logging in the security zone rules (either inbound or outbound). Table 41 System Log menu Command Description email Specifies the e-mail address to which log files are sent when the log interval or maximum log size is reached. Use this command in conjunction with the SMTP command. smtp Specifies the IP address of the SMTP mail server that hosts the e-mail address specified in the Email command. Specify the IP address in dotted decimal notation. Note: Configure the specified SMTP server to accept messages from the SMC. int Specifies the time interval for log rotation. The interval is specified in number of days and number of hours. size Specifies the maximum size a log file can reach before triggering rotation. The size is specified in kilobytes.

Secure Multimedia Controller Command Reference Table 42 identifies and describes the Firewall Log menu commands. UNIStim Log menu Using the UNIStim Log menu (/cfg/sys/log/arch/unistim), you can configure UNIStim log parameters. The secure UNIStim log contains all logging related to the secure UNIStim proxy and includes general information about its operation. The log also contains messages related to execution problems and security failures in the secure UNIStim protocol. Table 42 Firewall Log menu Command Description email Specifies the e-mail address to which log files are sent when the log interval or maximum log size is reached. Use this command in conjunction with SMTP command. smtp Specifies the IP address of the SMTP mail server that hosts the e-mail address specified in the Email command. Specify the IP address in dotted decimal notation. Note: Configure the specified SMTP server to accept messages from the SMC. int Specifies the time interval for log rotation. The interval is specified in number of days and number of hours. size Specifies the maximum size a log file can reach before triggering rotation. The size is specified in kilobytes.

Configuration menu NN10300-091 Standard 1.00 May 2006 Table 43 identifies and describes the UNIStim Log menu commands. User menu Using the User menu (/cfg/sys/user), you can add, modify, delete, or list SMC user accounts, and change passwords. The default user accounts are: • admin • oper • root Note: You cannot delete the default user accounts. Only the Administrator can change the passwords. Table 43 UNIStim Log menu Command Description email Specifies the e-mail address to which log files are sent when the log interval or maximum log size is reached. Use this command in conjunction with SMTP command. smtp Specifies the IP address of the SMTP mail server that hosts the e-mail address specified in the Email command. Specify the IP address in dotted decimal notation. Note: Configure the specified SMTP server to accept messages from the SMC. int Specifies the time interval for log rotation. The interval is specified in number of days and number of hours. size Specifies the maximum size a log file can reach before triggering rotation. The size is specified in kilobytes.

Secure Multimedia Controller Command Reference Table 44 identifies and describes the User menu commands. Table 44 User menu (/cfg/sys/user) Command Description passwd Changes the administrator password. The password can contain spaces and is case sensitive. There is no limitation on the number of characters. Only the admin user can perform this action. You are prompted to enter the current administrator password. Then, you are prompted to enter and confirm the new administrator password. expire <# of seconds> Specifies password expiration time in seconds. If you set the value to zero (the default), the password expiration is not activated. After a password expires, the user is prompted at logon to enter the old password once and the new password twice. Note: This command is visible only to users in the admin group, and does not apply to the root user. list Lists all editable user accounts. del Deletes oper user accounts. Only the admin user can delete user accounts. add Adds a user account. Only the admin user can perform this action. After adding a user account, you must also assign the account to a group using the User Edit menu. See “User Edit menu” on page 70. edit Displays the User Oper menu, which you can use to edit the user account passwords and group privileges for the specified user. For menu items, see “User Edit menu” on page 70. adv Displays the SSH User menu, which provides options for administering SSH user access. For menu items, see “SSH User Admin menu” on page 71.

Configuration menu NN10300-091 Standard 1.00 May 2006 User Edit menu Using the User Edit menu (/cfg/sys/user/edit ), you can change passwords and assign group privileges for the user account specified by the user name. Table 45 identifies and describes the User Edit menu commands. Table 45 User Edit menu (/cfg/sys/user/edit) Command Description password Changes the password for the selected user. The password can contain spaces and is case-sensitive. There is no limitation on the number of characters. Only the admin user can perform this action. You are prompted to enter the current administrator password. Then, you are prompted to enter and confirm the new user password. groups Adds or deletes the selected user to or from a group. The three predefined groups are admin, oper, and root. cur Displays the current user settings.

Secure Multimedia Controller Command Reference SSH User Admin menu Using the SSH User Admin menu (/cfg/sys/user/adv/user ), you can create an SSH account on the SMC to provide a specified user with SSH access to the SMC. You must specify a user name to open the menu. Table 46 identifies and describes the SSH User Admin menu commands. Groups menu Using the Groups menu (/cfg/sys/user/edit /groups), you can list, delete, or add groups. Table 46 SSH User Admin menu (/cfg/sys/user/adv/user ) Command Description name Specifies a descriptive name for the SSH account. pubkey Specifies the RSA/DSA public key for the SSH account. Note: The public key you enter must conform to OpenSSH v2 RSA or DSA format. ena Enables the SSH account for the specified user name. dis Disables the SSH account for the specified user name. del Deletes the SSH account.

Configuration menu NN10300-091 Standard 1.00 May 2006 Table 47 identifies and describes the Groups menu commands. Network Configuration menu Using the Network Configuration menu (/cfg/net), you can configure ports, gateways, Virtual Router Redundancy Protocol (VRRP), and Proxy ARP (PARP). Table 48 identifies and describes the Network Configuration menu commands. Table 47 Groups menu (/cfg/sys/user/edit/groups) Command Description list Lists all group members by index number and name; for example: 1: admin 2: oper del Deletes a member from the selected group. Specify the member by index number. add Adds a member to the selected group. Specify the member by index number. Table 48 Network Configuration menu (/cfg/net) Command Description port Displays the Port menu for the specified port, which you can use to configure physical ports on the SMC. For menu items, see “Port menu” on page 74. if Displays the Interface menu for the specified interface. For menu items, see “Interface menu” on page 74.

Secure Multimedia Controller Command Reference gateway Specifies the IP address of the SMC default gateway. Set the default gateway to the IP address of the network router interface adjacent to the SMC to allow remote administrative access through Telnet, SSH, and the BBI. routes Displays the Routes menu, which you can use to add, delete, or list static routes. The SMC uses these routes to transmit packets within the attached networks. For menu items, see “Routes menu” on page 77. vrrp Displays the VRRP Settings menu. For menu items, see “VRRP Settings menu” on page 77. parp Displays the Proxy ARP menu, which you can use to access the proxy ARP (PARP) list or enable PARP support in the SMC. For menu items, see “Proxy ARP menu” on page 79. Note: Use this command for testing the SMC in a lab environment; not in production. Table 48 Network Configuration menu (/cfg/net) Command Description

Configuration menu NN10300-091 Standard 1.00 May 2006 Port menu Using the Port menu (/cfg/net/port ), you can configure the port characteristics for a specified port. Table 49 identifies and describes the Port menu commands. Interface menu Using the Interface menu (/cfg/net/if), you can configure IP address interfaces for the SMC. Each IP address interface represents a network attached to the SMC. To ensure traffic flows through the SMC, configure the network device attached to an SMC port to use an SMC IP address interface or SMC VRRP interface as its default gateway. The IP address interface naming conventions are as follows: • ip1: Real IP Address of first host in a cluster Table 49 Port menu (/cfg/net/port) Command Description autoneg on | off Enables or disables link auto-negotiation. If auto-negotiation is disabled, the port operates at the speed set in the port speed command. Note: Enabling or disabling auto-negotiation can cause temporary interruption to network traffic on all ports. speed Specifies the link speed of the port. Enter the port speed as an integer representing megabytes per second (MB/s). For Fast Ethernet ports, you can set the speed to 10 or 100. For Gigabit Ethernet ports, the speed is fixed at 1000. mode full | half Sets the port duplex mode to either full-duplex or half-duplex mode. The default setting is full.

Secure Multimedia Controller Command Reference • ip2: Real IP Address of second host in a cluster • vrrp/vip: Floating IP address shared between both hosts in a cluster but owned by the VRRP master Table 50 identifies and describes the Interface menu commands. Table 50 Interface menu (/cfg/net/if) Command Description ip1 IP address for the first host in a cluster on a particular interface. Note: In a standalone SMC configuration, each interface has a single IP address (ip1) associated with it. In a High Availability (HA) configuration, three IP addresses are required to adequately configure an interface. The first two IP addresses (ip1 and ip2) define the real IP addresses of the two SMCs in the cluster; that is, one SMC owns ip1 and the other SMC owns ip2. The third IP address, the VRRP virtual IP, exists on the same subnet as the other two IP addresses and is owned by whichever SMC is the current HA master. If the current HA master machine fails, the backup SMC becomes the master and assumes responsibility for packets routed through the VRRP IP address. For related information, see “VRRP Settings menu” on page 77. ip2 IP address for the second host in a cluster on a particular interface. mask Configures the IP subnet address mask for the IP address interface using dotted decimal notation. vrrp Displays the Virtual Router Redundancy Protocol (VRRP) Interface menu, which you can use to configure an interface for HA. VRRP ensures that if the active SMC host fails, the redundant SMC host takes over. In an HA configuration, configure each participating IP address interface separately for VRRP. For menu items, see “VRRP Interface menu” on page 76.

Configuration menu NN10300-091 Standard 1.00 May 2006 VRRP Interface menu Using the VRRP Interface menu (/cfg/net/if /vrrp), you can configure redundant interfaces when two SMCs are present in a cluster. VRRP ensures that if the active host fails, the backup host takes over. The SMC interfaces (ip1 and ip2) form a virtual router. The virtual router IP address becomes the real IP address for both hosts, though the virtual router IP address is active only on the active master. Each subaddress must reside on the same network as the virtual router IP address. Note: Both hosts in the cluster must have the same configuration. The host configurations are automatically synchronized. Table 51 identifies and describes the VRRP Interface menu commands. mgmt Enables management on this interface. ena Enables this IP address interface. dis Disables this IP address interface. Table 51 VRRP Interface menu (/cfg/net/if/vrrp) Command Description vrid Assigns an ID for the virtual router interface. Configure the virtual router ID (VRID) on this interface the same for both the active master and the backup. Separate interfaces must have unique VRIDs. vip Defines the virtual IP address used to represent the SMC cluster in the virtual router. The vip address must reside in the same subnet as the interface IP address. Table 50 Interface menu (/cfg/net/if) Command Description

Secure Multimedia Controller Command Reference Routes menu Using the Routes menu (/cfg/net/route), you can add, delete, or list static routes. The SMC uses these static routes to route transmit packets to indirectly attached internal networks. You can configure up to 1000 static routes. Table 52 identifies and describes the Route menu commands. VRRP Settings menu Using the VRRP Settings menu (/cfg/net/vrrp), you can configure Virtual Router Redundancy Protocol (VRRP) parameters for the SMC cluster. Specify valid addresses for each SMC before you apply changes to the Table 52 Route menu (/cfg/net/route) Command Description list Lists all configured routes by their index number and IP address information. del Removes a route from the configuration by specifying the route index number. add Adds a static route based on destination IP address, destination subnet mask, and gateway IP address. Note: The gateway IP address must be previously specified and cannot be within the range specified by the destination IP address and mask. insert Adds a new static route at a specific position (index number) in the index. move Moves a static route from one position in the index to another.

Configuration menu NN10300-091 Standard 1.00 May 2006 parameter values. Both SMC hosts in the cluster must have the same configuration. Table 53 identifies and describes the VRRP Settings menu commands. Table 53 VRRP Settings menu (/cfg/net/vrrp) Command Description ha y | n Enables or disables HA. Two hosts must be previously installed and configured before you can enable HA. adint <1-3600> Displays the current advertisement interval in seconds and provides the option to change it. The active master sends a VRRP advertisement message to the backup host at the specified advertisement interval. Only the active master sends VRRP advertisement messages. If the backup host does not receive a VRRP advertisement from the active master within the advertisement interval, VRRP initiates VRRP failover. The default value is 3, which is the lowest recommended value. garp [1-600] Displays the current Gratuitous Address Resolution Protocol (GARP) value in seconds. You can change the GARP value. When the backup host determines that the active master failed, it immediately flashes a GARP message, which is an unsolicited ARP response, to all end-hosts on the virtual router interface. Then the backup host delays a period of time specified by the garp value before it begins sending continuous GARP messages. The GARP message forces end-hosts to update their ARP caches with the MAC/IP address mapping for the newly active SMC instead of waiting for end-hosts to acquire the MAC/IP address from periodic ARP requests. The default value is 1.

Secure Multimedia Controller Command Reference Proxy ARP menu Using the Proxy ARP menu (/cfg/net/parp), you can configure IP addresses to which the cluster sends ARP messages. The SMC can respond to ARP requests intended for devices behind the SMC, including VLAN and VRRP interfaces. gbcast <2-100> Displays the present Gratuitous Broadcast (gbcast) value. You can change the gbcast value. The gbcast value specifies the interval between GARP messages sent by the active master to ensure that all end-hosts have the correct MAC/IP address mapping. Increasing the gbcast value cuts down on the gbcast traffic, but lengthens the interval between end-host ARP cache updates. The gbcast value is multiplied by the adint value to determine the interval in seconds between GARP messages. For example, if your adint value is 10 and your gbcast value is 3, the interval between GARP messages is 30 (10 x 3) seconds. The default gbcast value is 2. afc y | n Enables or disables Advanced Failover Checking (AFC). When AFC is enabled, the system sends an ARP message before initiating a failover caused by missed VRRP advertisements. IMPORTANT! Use Proxy ARP for testing the SMC in lab environments when IP address allocation is an issue. Do not use Proxy ARP in production; instead each interface should exist on its own subnet. Table 53 VRRP Settings menu (/cfg/net/vrrp) Command Description

Configuration menu NN10300-091 Standard 1.00 May 2006 Table 54 identifies and describes the Proxy ARP menu commands. Table 54 Proxy ARP menu (/cfg/net/parp) Command Description enable y | n Enables or disables Proxy ARP for the cluster. Proxy ARP is disabled by default. iface Specifies the interface to proxy ARP messages for a subnet on a different interface. The subnet must contain the subnet address supported by the proxy ARP interface. Specify the name of the interface, such as intranet, management, or mcslan. garp Sends gratuitous ARPs on behalf of clients that are subnets supported by the proxy ARP interface. The gratuitous ARPs are sent from the proxy ARP interface.

Secure Multimedia Controller Command Reference Multimedia Security menu Using the Multimedia Security menu (/cfg/smc), you can define the security features of the SMC. Table 55 identifies and describes the Multimedia Security menu commands. Table 55 Multimedia Security menu (/cfg/smc) Command Description zone [zone_name} Displays the Security Zone menu, which you can use to configure the secure multimedia zones. For menu commands, see “Security Zone menu” on page 83. settings Displays the Settings menu, which you can use to configure SMC settings. See “SMC Settings menu” on page 89. unistim Displays the UNIStim Security menu, which you can use to create a secure UNIStim proxy server and specify the different policies to be applied to the users when they connect to the server. For menu commands, see “UNIStim Security menu” on page 100. network Displays the SMC Network menu, which you can use to specify the different networks used in configuring the SMC. The following networks are created during installation: • users networks: the subnets used by multimedia users • administrators networks: the subnets used by administrators Both users and administrators default to all networks. If required, you can can add more networks. For menu items, see “SMC Network menu” on page 110. service Displays the Service menu, which you can use to specify the services and protocols used for configuring the SMC firewall rules. Services map to a protocol and a series of port ranges. You can consolidate frequently used services into a single service specification and then use it repeatedly in firewall rules. For menu items, see “Service menu” on page 112.

Configuration menu NN10300-091 Standard 1.00 May 2006 flow Displays the Flow Control menu, which you can use to specify the different flow parameters for SMC firewall rules. For menu items, see “Flow Control menu” on page 86. addzone Initiates the Addzone Wizard, which guides you through the steps to add a new security zone to the system. Each SMC can support a maximum of four user-defined security zones. Each zone has a subnet and port associated with it and a collection of firewall rules that are applied to all traffic that flows into and out of the zone. After you add a zone, use the Auto command to incorporate predefined rules. Table 55 Multimedia Security menu (/cfg/smc) Command Description

Secure Multimedia Controller Command Reference Security Zone menu Using the Security Zone menu (/cfg/smc/zone), you can define security zones. Each zone represents a secure subnet, which contains the CS 1000 or MCS servers. Each security zone is associated with a subnet and a port. Each zone has a descriptive name. Two types of access rules exist for each zone: • inbound rules for traffic that flows into the zone • outbound rules for traffic that flows out of the zone If a packet does not match a rule, the packet is denied access. In general, the traffic flowing into the zone is from the intranet and therefore untrusted, such as SIP traffic from an IP phone to the signaling server. The majority of access rules are applied for inbound calls. The default outbound rules allow all traffic to exit the system. When you add the first rule, a wizard guides you through a host of questions to define the basic rule values. Subsequently, when you access any rule, the CLI displays the Rules menu. Each rule has a unique number, ranging from 1 through 1024. This number is used to sequentially order the rules. Rules are applied to incoming traffic in order according to the access number. A lower number means a higher priority; therefore, rules with lower numbers are applied first. Each rule is treated separately, and the first rule that matches a particular packet defines how that packet is handled. For example, if a packet matches two rules in the system, and the rule with the lower number allows the packet, and the rule with the higher number denies the packet, the packet is allowed.

Configuration menu NN10300-091 Standard 1.00 May 2006 Table 56 identifies and describes the Security Zone menu commands. Table 56 Security Zone menu (/cfg/smc/) Command Description irule [rule_number] Displays the Inbound Access menu for the specified rule. For menu items, see “Inbound Access menu” on page 85. orule [rule_number] Displays the Outbound Access menu for the specified rule. For menu items, see “Outbound Access” on page 87. [zone ] auto Initiates automatic rule generation, which guides you through the following steps: 1 Specify the multimedia users network, which is the collection of subnets upon which the IP phones reside. 2 Specify the administrators network, which is the subnet upon which the administrative clients reside. 3 [Optional] Delete existing rules. Note: If you choose yes, all current rules are replaced with the autogenerated rules. If you choose no, the autogenerated rules are appended. Duplicate rules are not eliminated. 4 Select one or more rule groups to apply to a particular security zone. Note: You can add numerous rule groups in a single wizard session. 5 Apply the rules. cur Displays the current security zone settings. del Deletes the security zone.

Secure Multimedia Controller Command Reference Inbound Access menu Using the Inbound Access menu (cfg/smc/irule), you can specify inbound access rules. Table 57 identifies and describes the Inbound Access menu commands. Table 57 Inbound Access menu Command Description enable Enables or disables the rule. Disabled rules are ignored. source Specifies the source network for the traffic. The source network is generally located within the intranet and is untrusted. If the source value is an asterisk (*), all source IP addresses match this rule. dest Specifies the destination network for the traffic. For an inbound rule, this represents the subnet of the security zone, or individual IP addresses within the zone. If the dest value is an asterisk (*), all destination addresses match this rule. service Details the protocol (TCP, UDP, ICMP) and ports for the traffic that matches this rule. If the service value is an asterisk (*), all types of traffic match this rule. custom Displays the Custom Service menu, which you can use to define custom services for individual rules. You can specify the minimum port, maximum port, and protocol of the service. If you specify a custom service, it overrides the normal service specification. action Specifies whether to allow or deny traffic for this rule. flow Displays the Flow Control menu, which you can use to specify flow control for the specified rule. The flow control applies only to this individual rule and the traffic that maps to it. For menu items, see “Flow Control menu” on page 86.

Configuration menu NN10300-091 Standard 1.00 May 2006 Flow Control menu Using the Flow Control menu (/cfg/smc/flow/), you can specify the different flow parameters for SMC firewall rules. Table 58 identifies and describes the Flow Management menu commands. log Defines whether matches to the rule are logged to file. You can view logs in the CLI or BBI. The SMC firewall logs follow Webtrends Extended Log Format (WELF). The location of the log file is /logs/firewall.log. Note: Too many firewall logs can affect SMC performance. Nortel recommends you update the firewall log configuration to prevent this degradation in performance. For more information, see Secure Multimedia Controller: Planning and engineering (NN42320-200). comment Specifies a comment to identify what traffic the rule currently matches. del Deletes this rule. When you delete a rule, its rule number becomes reusable. Table 58 Flow Management menu Command Description name Defines the name of the flow. maxconn Defines the maximum number of connections for a given rule. For example, a value of five (5) indicates a maximum of five concurrent connections. conns Defines the rate at which the connections are created per unit of time (defined in seconds) for a given firewall rule. For example, if the number of connections is 5 and the interval is 1, it indicates that in 1 second a maximum of five connections are created. The limit is applied unidirectionally. Table 57 Inbound Access menu Command Description

Secure Multimedia Controller Command Reference Outbound Access Using the Outbound Access menu (/cfg/smc/zone /orule), you can configure outbound rule parameters. Table 59 identifies and describes the Outbound Access menu commands. packets Defines the number of packets that are transmitted per unit of time (defined in seconds) for a given firewall rule. For example, if the number of packets is set to five and the interval is one, it indicates in one second a maximum of five packets can transmit for the policy. The limit is applied bidirectionally. bandwidth Defines the amount of traffic (measured in kilobytes) that is transmitted per unit of time (defined in seconds) for a given firewall rule. For example, if the number specified is 10 KB and the interval set to one (1), it indicates that in one second a maximum of 10 kilobytes of data is transmitted through for this firewall rule. The limit is applied bidirectionally. comment Specifies a comment for this flow. del Removes the flow. Table 59 Outbound Access menu Command Description enable Enables or disables the rule. Disabled rules are ignored. source Specifies the source network for the traffic. dest Specifies the destination network for the traffic. service Details the protocol (TCP, UDP, ICMP) and ports for the traffic that matches this rule. If the service value is an asterisk (*), all types of traffic match this rule. Table 58 Flow Management menu Command Description

Configuration menu NN10300-091 Standard 1.00 May 2006 custom Display the Custom Service menu, which you can use to define custom services for individual rules. You can specify the minimum port, maximum port, and protocol of the service. If you specify a custom service, it overrides the normal service specification. action Specifies whether to allow or deny traffic for this rule. flow Displays the Flow Control menu, which you can use to specify flow control for the specified rule. The flow control applies only to this individual rule and the traffic that maps to it. For menu items, see “Flow Control menu” on page 86. log Enables rule logging. The location of the log file is /logs/firewall.log. Note: Too many firewall logs can affect SMC performance. Nortel recommends you update the firewall log configuration to prevent this degradation in performance. For more information, see Secure Multimedia Controller: Planning and engineering (NN42320-200). comment Defines a comment to identify what traffic the rule currently matches. del Deletes this rule. When a rule is deleted, its rule number can is reusable. Table 59 Outbound Access menu Command Description

Secure Multimedia Controller Command Reference SMC Settings menu Using the SMC Settings menu (/cfg/smc/settings), you can configure security settings. Table 60 identifies and describes the SMC Settings menu commands. Table 60 SMC Settings menu Command Description attack Enables or disables the following advanced firewall attacks: • SYN Flooding • Source Routing • WinNuke • Mime Flood • FTP Bounce • IP Unaligned Timestamp • Sequence Number Prediction • Sequence Number Out Of Range • ICMP Redirect • ICMP Error Messages For detailed descriptions of these firewall attacks, see Appendix A on page 121. log Displays the Message Logging menu, which you can use to customize the types of messages sent to /logs/firewall.log. For menu items, see “Message Logging menu” on page 90. Note: Too many firewall logs can affect SMC performance. Nortel recommends you update the firewall log configuration to prevent this degradation in performance. For more information, see Secure Multimedia Controller: Planning and engineering (NN42320-200).

Configuration menu NN10300-091 Standard 1.00 May 2006 Message Logging menu Using the Message Logging menu (/cfg/smc/settings/log), you can customize the types of messages sent to /logs/firewall.log. Doing so helps to limit the file size of the firewall log. The firewall log contains all logging messages that relate to firewall operation, specific attacks, and basic packet logging due to the log settings in the firewall inbound/outbound rules. On the SMC, the firewall log files are stored in logs/firewall.log. Firewall logs can also be: alg Displays the ALG menu, which you can use to enable or disable application layer gateway support for a variety of protocols. Without ALG support, some of these protocols cannot traverse the SMC. For menu items, see “ALG menu” on page 96. maxconn/ /conn Specifies the maximum connection limits for individual zones. The total number of concurrent connections supported in the SMC across all zones is 700 000. Traffic flowing between zones is counted as a concurrent connection within the intranet zone, so Nortel recommends that the zone have the highest maxconn value. The default value is 100000. timeout Displays the Timeout menu, which you can use to specify inactivity timeout values associated with network traffic. For menu items, see “Timeout menu” on page 97. portbypass Displays the Port Bypass menu, which you can use to bypass the SMC’s stateful processing of packet to and from a given set of TCP ports. For menu items, see “Port Bypass menu” on page 98. multicast Displays the Multicast Bypass menu, which you can use to identify a specific Multicast Groups for which you want the SMC to bypass the processing and bridge the packets onto another network. For menu items, see “Multicast Bypass menu” on page 99. Table 60 SMC Settings menu Command Description

Secure Multimedia Controller Command Reference • viewed in the BBI or the CLI. • streamed in real-time to a firewall log using the /cfg/sys/log/firewall command. See “Platform Logging menu” on page 60. • e-mailed to an appropriate e-mail address. Firewall logs can become quite large in high-traffic environments, slowing down the SMC and filling up disk space. Nortel recommends that you modify the firewall logging configuration appropriately if the log files are filling up too quickly. The SMC uses the industry standard Webtrends Extended Log Format (WELF) for logging the network activity. The following text is a sample of a log message in WELF generated by syslog. Apr 18 04:25:52 172.16.1.247 id=firewall time="2002-04-18 16:15:34" fw=DEVICE1 pri=6 proto=6(tcp) src=172.16.7.246 dst=66.218.70.149 msg=Service access request successful Src 3171 Dst 80 from EXT n/w agent=Firewall Table 61 identifies and describes the Message Logging menu commands. Table 61 Message Logging menu Command Description messages Enables and disables various logging message types. For menu commands, see “Messages menu” on page 92. threshold Sets the various thresholds for log messages sent to the remote firewall log server as specified in the Platform Logging menu. See “Platform Logging menu” on page 60. For menu commands, see “Thresholds menu” on page 94. rate Displays the Rate Limit menu for log messages sent to the remote firewall log server as specified in the Platform Logging menu. See “Platform Logging menu” on page 60. For menu commands, see “Rate Limit menu” on page 95.

Configuration menu NN10300-091 Standard 1.00 May 2006 Messages menu Using the Messages menu (/cfg/smc/settings/log/messages), you can enable or disable specific types of firewall logs. verbose Enables verbose generation of log messages. By default, this parameter is disabled. Note: Too many firewall logs can affect SMC performance. Nortel recommends you update the firewall log configuration to prevent this degradation in performance. For more information, see Secure Multimedia Controller: Planning and engineering (NN42320-200). queue Indicates the maximum number of log messages that are queued. This value can be in the range of 1-75. A higher number increases performance because the log messages are batched and sent at a single time; however, it also increases the time it takes for a message to be logged. attack Specifies a threshold for how many attack packets the firewall detects before log messages are generated. Only one attack message is logged for every nth attack packet. You can limit the total number of attack packets that are logged. For example, if this number is set to 5, only one of every five attacks are logged regardless of the type of attack. Note: This can lead to message loss. policy Specifies a threshold for how many attack packets the firewall cannot match to a policy before log messages are generated. Only one attack message is logged for every nth attack packet. You can limit the total number of attack packets that are logged. For example, if this number is set to 5, only one of every five attacks are logged regardless of whether of the type of attack. Note: This can lead to message loss. Table 61 Message Logging menu Command Description

Secure Multimedia Controller Command Reference Table 62 identifies and describes the Messages menu commands. Table 62 Messages menu Command Description synflood Enables and disables logging of messages that are generated as a result of TCP SYN flooding. ping Enables and disables logging of messages that are generated as a result of a ping of death attack. winnuke Enables and disables logging of messages that are generated every time a WinNuke attack is detected. syserror Enables and disables logging of messages that are generated by the SMC, such as memory allocation failures. deny Enables and disables logging of messages that are generated because of deny access policies. allow Enables and disables logging of messages that are generated at the end of every connection in firewall. unavail Enables and disables logging of messages that are generated as a result of dropping packets due to non-availability of access policies. attacks Enables and disables logging of messages that are generated when the firewall treats invalid packets as an attack. data Enables and disables logging of messages that are generated as a result of dropping packets because of application command filtering. ipspoof Enables and disables logging of messages that are generated as a result of spoofed IP packets. ipopt Enables and disables logging of messages that are generated when attacks based on IP options occur. access Enables and disables logging of messages that are generated when a policy is accessed.

Configuration menu NN10300-091 Standard 1.00 May 2006 Thresholds menu Using the Threshold menu (/cfg/smc/settings/log/threshold), you can set the message threshold to limit the number of repetitive messages sent to the remote firewall log server (/cfg/sys/log/firewall). Messages are repetitive if more than the one message contains the same message ID, protocol, source IP address, destination IP address, source port, and destination port. For example, the following parameters create a message queue for 200 issues: • count = 10 • threshold time = 60 seconds • scan time = 1 second • max issues = 200 Repetitive messages create one issue entry in the message queue. Each occurrence of the same message during 60 seconds increments the count of the issue entry. The first message is always forwarded to the firewall log. The tenth message within 60 seconds is also sent to the firewall log. If less than 10 instances of the same message arrive within 60 seconds, another message with the current count is sent to the firewall log at the 60 second expiration. The queue is scanned every scantime equals 1 second, and message issue entries older than 60 seconds are sent to the firewall log if the count is any number other than zero. If the count is zero, the message is not sent to the firewall log. Table 65 identifies and describes the Threshold menu commands. Table 63 Threshold menu Command Description count Specifies the threshold count, which is the maximum number of repetitive messages to accumulate in the queue before sending the issue to the firewall log. time Specifies the threshold time, which is the time interval over which the number of messages are accumulated.

Secure Multimedia Controller Command Reference Rate Limit menu Using the Rate Limit menu (/cfg/smc/settings/rate), you can specify the limit of log messages sent to the remote firewall log server. These messages are averaged over a period of time and rate-limited accordingly. For example, the following parameters rate-limit the messages sent to the firewall log to 1 per millisecond: • msgcount = 1000 • period = 1 Any message over this limit is dropped. Table 65 identifies and describes the Rate Limit menu commands. scan time Specifies the time interval at which the issues queue is scanned. For example, if the scan time is 1 second, the issues queue is scanned every 1 second. max issues Specifies the maximum size of the issues queue. Table 64 Rate Limit menu Command Description msgcount Specifies the total message count allowed over the time period specified in the Period command. Note: Messages are counted; packets or bytes are not counted. period Specifies the time period over which messages are allowed. Table 63 Threshold menu Command Description

Configuration menu NN10300-091 Standard 1.00 May 2006 ALG menu Using the ALG menu (/cfg/smc/settings/alg), you can enable or disable application layer gateway support for a variety of protocols. Without ALG support, some of these protocols are unable to traverse the SMC. Table 65 identifies and describes the ALG menu commands. Timeout menu Using the Timeout menu (/cfg/smc/settings/timeout), you can configure timeout values for TCP, UDP, ICMP protocols, TCP RESET, and services. The following timeout values are configurable for the following connections: • TCP-based (default is 600 seconds) • UDP (default is 1200 seconds) • ICMP (default is 60 seconds) After the timeout value is reached, the firewall association database maintained for a connection is removed. The timeout value is also configurable for the TCP RESET command. The default value for this timeout is 30 seconds. You can also configure a timeout value for a particular service or application. For example, if you configure a service timeout record of 100 for FTP service, and the TCP used by an FTP application has a default timeout of 600, the FTP connection still has a timeout of 100. Table 65 ALG menu Command Description ftp Enables FTP. FTP is enabled by default. tftp Enables TFTP. TFTP is disabled by default. rpc Enables RPC. RPC is disabled by default. pcanywhere Enables PCAnywhere. PCAnywhere is disabled by default.

Secure Multimedia Controller Command Reference Table 66 identifies and describes the Timeout menu commands. Custom Timeout menu Using the Custom Timeout menu (/cfg/smc/settings/timeout/custom), you can configure timeout parameters for specific TCP/UDP ports or protocols. Table 67 identifies and describes the Custom Timeout menu commands. Table 66 Timeout menu Command Description udp Specifies the inactivity timeout value after which the UDP connection is removed. The default value is 1200 seconds. icmp Specifies the inactivity timeout value after which the ICMP connection is removed. The default is 60 seconds. pre Specifies the timeout value after which a connection receiving a TCP RESET is removed. The default is 30 seconds. tcp Specifies the timeout value after which a TCP connection is removed. The default is 600 seconds. custom Displays the Custom Timeout menu, which you can use to configure timeout parameters for a specific TCP/UDP ports or protocols. For menu items, see “Custom Timeout menu” on page 97. Table 67 Custom Timeout menu Command Description name Specifies a custom timeout name. proto Specifies the allowed protocol. port Specifies the service port number. timeout Specifies the service timeout in terms of seconds. delete Removes the custom timeout.

Configuration menu NN10300-091 Standard 1.00 May 2006 Port Bypass menu Using the Port Bypass menu (/cfg/smc/settings/portbypass), you can identify a specific set of TCP ports for which you want the SMC’s stateful processing to bypass. You can add, modify, and delete the IP addresses for the TCP ports you want to bypass. When the Port Bypass feature is enabled, the SMC does not process or check all packets matching the port list. The default entry in the port list is the IP address, 0.0.0.0, which indicates every TCP port is bypassed when the Port Bypass feature is enabled. Alternatively, you can add IP addresses of the specific TCP ports you want the SMC to bypass. You can configure up to a maximum of four sets of port and IP addresses. Table 68 identifies and describes the Port Bypass menu commands. Table 68 Port Bypass menu Command Description enable Enables the Port Bypass feature. disable Disables the Port Bypass feature. portlist Displays the Port List menu, which you can use to add, modify, or delete IP addresses to the list of port list. For menu commands, see “Port List menu” on page 99.

Secure Multimedia Controller Command Reference Port List menu Using the Port List menu (/cfg/smc/settings/portbypass/portlist), you can add, modify, and delete IP addresses from list of ports to bypass. Table 69 identifies and describes the Port List menu commands. Multicast Bypass menu Using the Multicast Bypass menu (/cfg/smc/settings/multicast), you can identify a specific multicast groups for which you want the SMC to bypass the processing and bridge the packets onto another network. When the Multicast Bypass feature is enabled, the SMC bridges all packets matching the mcastlist from their source network to their destination network. You can add, modify, and delete the multicast addresses, source network, and destination network you want to bridge. You can configure up to a maximum of eight multicast groups along with their source and destination network. Table 70 identifies and describes the Multicast Bypass menu commands. Table 69 Port List menu Command Description add Adds the IP address you specify to the port list. modify Modifies the IP address you specify. delete Deletes the IP address you specify from the port list. Table 70 Multicast Bypass menu Command Description enable Enables the Multicast Bypass feature.

Configuration menu NN10300-091 Standard 1.00 May 2006 Multicast List menu Using the Multicast menu (/cfg/smc/settings/multicast/mcastlist), you can add, modify, and delete multicast groups, source network, and destination network from the Multicast List to bypass. Table 71 on page 100 identifies and describes the Multicast List menu commands. UNIStim Security menu Using the UNIStim Security menu (cfg/smc/unistim/), you can define all settings necessary to create a secure UNIStim proxy server and specify the different policies that are applied to the users when they connect. disable Disables the Multicast Bypass feature. mcastlist Displays the Multicast List menu, which you can use to add, modify, or delete multicast group info to the mcastlist to bypass. For menu commands, see “Multicast List menu” on page 100. Table 71 Multicast List menu Command Description add Adds the multicast group address, source network, and destination network you specify to the mcastlist. modify Modifies the multicast group address, source network, and destination network you specify. delete Deletes the multicast group address, source network, and destination network you specify if already existing in the Mcastlist. Table 70 Multicast Bypass menu Command Description