# Interface Configuration

## Physical (Ethernet) Interface

Each port on your device represents a physical interface. You must bind a physical interface to a zone to allow traffic to enter and exit the zone. Without an interface, no traffic can enter or exit the zone. Three of the physical (Ethernet) interfaces are bound by default to specific zones: Trust, Untrust, and DMZ. The default binding of physical interfaces to zones varies by device model

### To Configure a Physical (Ethernet) Interface

Note: The interface configuration options you see depend upon your device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, click Edit for the physical (Ethernet) interface you want to configure, and then enter the necessary information:

Interface Name: (Read-only) A physical interface name includes the media type, slot number (for some devices), and port number (for example, ethernet3/2 or ethernet2).

As Member of loopback group: To allow the interface to use the mapped Internet Protocol (MIP) on the loopback interface, configure the interface as a member of the loopback interface group.

As Member of group: Select the redundant or aggregate interface of which you want to assign this physical interface as a member.

Zone Name: Enter the name of the zone to which the interface is bound.

Obtain IP using DHCP: (Some devices only) Select this option to enable the device to act as a Dynamic Host Configuration Protocol (DHCP) client, receiving a dynamically assigned IP address for its interface from an Internet Service Provider (ISP).

Automatic update DHCP server parameters: Select this check box to forward TCP/IP settings from the DHCP client module on the Untrust interface to the DHCP server module on the default interface in the Trust zone.

Obtain IP using PPPoE: (Some devices only) Select this option to enable the device to act as a Point-to-Point Protocol over Ethernet (PPPoE) client, receiving an IP address for its interface from an ISP.

Create new PPPoE setting:You can configure a new instance of PPPoE, which, once you save it, you can add to the Obtain IP using the PPPoE drop-down list..

Connect: Click this button to initiate a PPPoE session, or click Disconnect to terminate a session.

Status: (Read-only) The status of a PPPoE session is indicated as either Disabled (currently inactive) or Enabled (currently in progress).

Static IP: (Some devices only) Select this option to assign a unique and fixed Internet Protocol (IP) address to the interface.

IP Address/Netmask: Enter the IP address and netmask of the interface.

Manageable: Select this option to enable management of the device using the interface IP address.

Manage IP: The logical IP address through which you can manage the device. You can set a different manage IP address on each available interface. The manage IP address must be on the same subnet as the physical IP address.

Interface Mode: (Appears only when you enter and save a static IP address and netmask) Select NAT so that the IP addresses of the devices on this interface have private, nonroutable IP addresses. Select Route so that the IP addresses of the devices on this interface have public, routable IP addresses. NAT is the default.

Note: Interface-based NAT applies only to traffic sent to the Untrust zone. To use NAT for traffic sent to other zones, you must specify it in a policy.

For more information about operational modes such as NAT, Route, or Transparent, see Operational Modes.

Block Intra-Subnet Traffic: (available only for tunnel interfaces with an IP address/netmask) Select this check box to block traffic that exits the same interface that it entered.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they resend the request. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

Overbilling: (Some devices only) Enables the device to receive and send overbilling attack information through this interface.

Enforce-IPSEC: (Some devices only) Sets the interface to accept only incoming connections from an IPSec tunnel.

Maximum Transfer Unit (MTU): If the MTU of the network to which the interface connects is smaller than 1500 bytes (the default), enter that value here.

DNS Proxy: Select this option if you want the security device to proxy (forward) Domain Name Service (DNS) queries received on this interface to the appropriate DNS server as configured on the DNS Proxy Configuration page.

Note: The DNS Proxy option does not apply to Layer 2 interfaces.

NTP Server: Select this option to make the security device act as an NTP server serving requests from the subnet peers

W ebAuth: (Appears only when you enter and apply an IP address/netmask) Select this option to enable WebAuth authentication for this interface. Enter the IP address that receives authentication requests for the WebAuth server. The WebAuth IP address must be in the same subnet as the interface IP address.

SSL Only: Select this option to require that all WebAuth authentication requests use SSL. URLs must include https://, followed by the IP address that receives authentication requests for the WebAuth server (for example, https://ip_addr).

G-ARP: Select this option to allow incoming gratuitous ARP requests and replies on this interface.

Note: G-ARP selection is not supported on loopback interface, tunnel interface, all serial interfaces (including serial interface, dialer interface and multilink interface on wan interface), dsl interface, wan interface (including t1 e1 isdn interface) and wlan interface.

Traffic Bandwidth:The traffic bandwidth in kilobits per second (Kbps) that you assign to the interface. Enter the maximum bandwidth for ingress and egress traffic.

VRRP: Select this option to set Virtual Router Redundancy Protocol as the high availability (HA) protocol.

Note: VRRP and NSRP cannot exist on the same security device.

VRRP Enable: Select this option to enable VRRP for the selected interface. This option is available only after you have set VRRP as the HA protocol for this interface.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

### To Configure a Physical (Serial) Interface

1. On the Interface List page, click Edit for the serial interface, and then enter the necessary information:

Interface Name: (Read-only) The Media Access Control (MAC) address for the serial interface appears in parentheses.

Zone Name: The name of the zone to which the interface is bound.

2. Click OK to save your changes and return to the Interface List page. Click Apply to configure the ISP and modem settings for the serial interface.

### ISP Configuration

You configure the device to automatically dial to an Internet Service Provider (ISP) account when failover to the serial interface occurs. To configure ISP information for the serial interface, click ISP.

For more information, see ISP Configuration.

### Modem Configuration

You configure the device to automatically dial to an ISP account when failover to the serial interface occurs. To configure modem information for the serial interface, click Modem.

For more information, see Modem Configuration.

### To Configure a Physical (WAN) Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, click Edit for the serial interface, and then enter the necessary information:

Interface Name (Read-only): The name of a physical interface is composed of the media type, slot number (for some devices), and port number, for example, serial1/0 or serial6/0.

WAN Configuration

Member Link: Select this option if the interface is to be added to a multilink interface (also called a bundle).

Note: You must create the multilink interface, configure the encapsulation, and bind the multilink interface to a security zone before member links can be added. To create and configure a multilink interface, see See PPP options or Frame Relay options.

Multilink Interface: Select the multilink interface to which the WAN interface is added.

Main Link: Select this option if the WAN interface is not part of a multilink interface.

BRI Mode: Select either Leased Line or Dial Using BRI to configure the device for ISDN support.

Note: If you uncheck Leased Line and Dial Using BRI and click Apply, then the
Dialer Poollink is displayed at the top of the Interface Properties screen. The dialer pool is another method for configuring the device for ISDN support using the dialer interface Configuring your device for ISDN support:
Use the dialer interface method to dial out to multiple destinations, when the number of destinations exceeds the number of available physical lines.
This configuration supports dial-on-demand Routing (DDR) and bandwidth-on-demand.
The dialer pool utilizes ISDN BRI by using logical dial peers via the dialer interfaces. This separates the actual physical links from all the potential destinations. A physical interface (brix/0) is configured as a member of a dialer pool. The physical interface can also belong to more than one pool, allowing the single line to be used to dial more than one destination..

Leased Line Mode:The interface in this mode is a Layer 3 interface and is predefined for a data rate of 128 Kbps. There is no signaling on the D-channel and the leased line is only used to deliver data. Leased Line mode supports PPP encapsulation only.

Dial Using BRI: Check this option to use the ISDN BRI to dial out. Click Apply and edit the Dialer Enable Options Edit the following to configure the dialer for Basic Rate Interface (BRI):
Primary and Alternative Number: Enter the remote destination to call. If the primary number is not connected, alternative-number is used. The primarynumber and alternative-number is a string of characters 1-15.
Load Threshold: Enter the threshold (in percent) to set up the second B-channel. For bandwidth on demand, if traffic is greater than the defined load-threshold, the second B-channel is setup. The range for this B-channel is 1 to 100. The default is 80.
Idle Time: If there is no traffic before the idle-time expires (in seconds), the connection is lost. The range for idle time is 0 to 60000, where 0 = never idle. The default is 180.
Retry Times: Enter the number of times to redial if the dial number fails. The range is 1-6 and the default is 3.
Interval: The dial interval (in seconds) between retries. The range is from 1 to 60 and the default is 30..

WAN Encapsulation:

None: Sets no encapsulation method.

PPP: Sets the WAN interface to use Point-to-Point protocol as the encapsulation method.

Frame Relay: Sets the WAN interface to use Frame Relay as the encapsulation method.

Cisco HDLC: Sets the WAN interface to use Cisco HDLC as the encapsulation method.

Binding a PPP Profile (appears after you select PPP or MLPPP encapsulation and click Apply): Select the PPP access profile.

Note: For an interface with PPP encapsulation, you must bind a PPP access profile to the interface. You must create a PPP access profile even if no authentication is used on the PPP data link. See PPP access profiles.

Zone Name: Select the zone to which the interface is bound.

Fixed IP option:

IP Address/Netmask: Enter the IP address and netmask of the interface.

Manageable: Select this option to enable management of the device using the interface IP address.

Manage IP: The logical IP address through which you can manage the device. You can set a different Manage IP address on each available interface. The Manage IP address must be on the same subnet as the physical IP address.

Unnumbered: Sets the WAN interface to use an unnumbered interface.

Interface: Selects the unnumbered interface.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Path MTU (IPV4): Sets the device to use the smallest MTU for all the links in a path.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they resend the request. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

Maximum Transfer Unit (MTU): The default protocol MTU is 1500 bytes for serial, T1, E1, ISDN BRI, and multilink interfaces and 4470 bytes for T3 interfaces. If the MTU of the network to which the interface connects is different, enter that value here. You can specify a value between 1280 and 8192 bytes.

Traffic Bandwidth: The traffic bandwidth in kilobits per second (Kbps) that you assign to the interface. Enter the maximum bandwidth for ingress and egress traffic.

DNS Proxy: Select this option if you want the device to proxy (forward) Domain Name Service (DNS) queries received on this interface to the appropriate DNS server as configured on the DNS Proxy Configuration page.

Note: The DNS Proxy option does not apply to Layer 2 interfaces.

WebAuth: (Appears only when you enter and apply an IP address/netmask) Select this option to enable WebAuth authentication for this interface.

IP: Enter the IP address that receives authentication requests for the WebAuth server. The WebAuth IP address must be in the same subnet as the interface IP address.

SSL Only: Select this option to require that all WebAuth authentication requests use SSL. URLs must include https://, followed by the IP address that receives authentication requests for the WebAuth server (for example, https://ip_addr).

After you configure the Basic WAN interface parameters, you can configure specific WAN interface options. To configure WAN interface features, click WAN at the top of the Interface Properties screen. Depending on the interface you are configuring, you will see one of the following options:

- Serial Interface Options

- T1 Interface Options

- E1 Interface Options

- T3 Interface Options

- ISDN Options

- Dialer Pool Options

Once you configure the Basic WAN interface parameters, you can configure WAN encapsulation settings. To configure the encapsulation method, click PPP, FR, or Cisco HDLC at the top of the page:

To configure PPP options for the interface. See PPP options.

To configure Frame Relay options for the interface. See Frame Relay options.

To configure Cisco HDLC options for the interface. See Cisco HDLC options.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

## Vlan1 Interface

Interfaces on a device in Transparent mode can be managed only through the VLAN1 interface. The VLAN1 interface has, in fact, two main purposes: to provide an address for managing the device, and to terminate VPN traffic when the device is in Transparent mode. The VLAN1 interface has similar configuration and management abilities to a physical interface.

### To Configure the VLAN1 Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, click Edit for the VLAN1 interface, then enter the necessary information:

Interface Name: (Read-only) The name of the interface is VLAN1.

Zone Name: (Read-only) The VLAN1 interface is bound to the VLAN zone.

IP Address/Netmask: Enter the IP address and netmask of the VLAN1 interface.

Manageable: Select this option to enable management of the device using the interface IP address.

Note: To allow hosts in the VLAN1 zones to manage the VLAN1 interface, set the IP address in the same subnet as the hosts.

Manage IP: The logical IP address through which you can manage the device. You can set a different Manage IP address on each available interface. The Manage IP address must be on the same subnet as the physical IP address.

Broadcast:

Arp: Select this option to enable the device to send Address Resolution Protocol (ARP) requests through this interface.

Trace Route: When this option is enabled, the device generates a trace-route packet (an ICMP echo request, or ping) at the same time as it generates an ARP query (arpq) with a time-to-live (TTL) flag of 1. You can disable this option.

Flood: Select this option to enable the device to use flooding.

Bypass Non-IP Packets: Select All to allow non-IP traffic, such as IPX, to pass through the device in Transparent mode. (ARP is a special case for non-IP traffic. It is always passed, even if the feature is disabled.) Select Broadcast/Multicast to allow only broadcast and multicast traffic to pass through. Select Off to disable the feature.

Bypass IPSec Packets for Others: Select this option to pass all IPSec traffic through the device in Transparent mode. The device does not act as a VPN tunnel gateway, but passes the IPSec packets onward to other gateways.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they send the request again. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

Vlan Trunk: Select this option to have the device forward VLAN tagged frames according to MAC addresses, ignoring the VLAN tags. If this option is not selected, the device drops VLAN tagged frames. For this feature to work, the device must be in Transparent mode.

DNS Proxy: Select this option if you want the device to proxy (forward) Domain Name System (DNS) queries received on this interface to the appropriate DNS server as configured on the DNS Proxy Configuration page.

WebAuth: (Appears only when you enter and apply an IP address/netmask) Select this option to enable WebAuth authentication for this interface. Enter the IP address that receives authentication requests for the WebAuth server. The WebAuth IP address must be in the same subnet as the interface IP address.

SSL Only: Select this option to require that all WebAuth authentication requests use SSL. URLs must include https://, followed by the IP address that receives authentication requests for the WebAuth server (for example, https://ip_addr).

Note: When interfaces are operating in Transparent mode, you must also enable WebAuth for all security zones hosting interfaces that receive WebAuth authentication requests.

G-ARP: Select this option to allow incoming gratuitous ARP requests and replies on this interface.

Note: G-ARP selection is not supported on loopback interface, tunnel interface, all serial interfaces (including serial interface, dialer interface and multilink interface on wan interface), dsl interface, wan interface (including t1 e1 isdn interface) and wlan interface.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

## Layer 2 Interface

When you configure an interface in one of the Layer 2 zones, it gets added to the layer 2 domain shared by all interfaces in all the Layer 2 zones.

All hosts in the Layer 2 zones must be on the same subnet to communicate, and you must define policies to allow hosts to communicate between zones. For more information about access policies, see Policy List.

### To Configure a Layer 2 Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, click Edit for the appropriate interface, and then enter the necessary information.

Interface Name: (Read-only) The name of the interface.

Zone Name: Select the Layer 2 zone to which the interface is bound.

IP Address/Netmask: Enter 0.0.0.0. In Transparent mode, the IP addresses of interfaces are set at 0.0.0.0.

G-ARP: Select this option to allow incoming gratuitous ARP requests and replies on this interface.

Maximum Transfer Unit (MTU): If the MTU of the network to which the interface connects is smaller than 1500 bytes (the default), enter that value here.

Traffic Bandwidth: The traffic bandwidth in kilobits per second (Kbps) that you assign to the interface.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

Note: You can enable management services and other services, such as ping, at the zone level.

## Wireless Interface (Some Devices Only)

A wireless interface is a logical interface that can be bound to a security zone. Some WLAN devices require the wireless interface to be in a separate subnet from all other interfaces, both wired and wireless. You can configure a wireless interface very similarly to an Ethernet interface. Each wireless security device supports up to four wireless interfaces which can be active simultaneously. Some WLAN devices show the wireless interfaces as wireless0/0 wireless0/3. An important difference between a wireless and a wired interface is that you must associate a service set identifier (SSID) with a wireless interface.

### To Configure a Wireless Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, click Edit for the appropriate interface, then enter the necessary information:

Interface Name: (Read-only) The name of the interface.

As Member of loopback group: To allow the interface to use the mapped Internet Protocol (MIP) on the loopback interface, configure the interface as a member of the loopback interface group.

Zone Name: Select the zone.

Bind to SSID: Select the SSID assigned to the interface.

Wlan Mode: For security devices with two radios, select which radio the wireless interface uses:

- 2.4G(802.11b/g): Enables only the 2.4 GHz radio for 802.11b and 802.11g.

- 5G(802.11a): Enables only the 5 GHz radio for 802.11a.

- Both(802.11a/b/g): Enables both radio on the interface for 802.11a, 802.11b, and 802.11g. This is the default setting.

IP Address/Netmask: Enter the IP address and netmask of the interface.

Manageable: Select this option to enable management of the device using the interface IP address.

Manage IP: The logical IP address through which you can manage the device. You can set a different Manage IP address on each available interface. The Manage IP address must be on the same subnet as the physical IP address.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they send the request again. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

SSH: Select this option to enable management using a secure command shell (SCS). You can administer the device from an Ethernet connection or a dial-in modem using SCS (which is SSH-compatible). To do this, you must have an SCS client that is compatible with Version 1.5 of the SSH protocol. These clients are available for Windows 95, Windows 98, Windows NT, Linux, and UNIX. The device communicates with the SCS client through its built-in SCS server, which provides device configuration and management services.

WebAuth: Select this option to enable WebAuth authentication through this interface. Enter the IP address of the WebAuth server performing the authentication.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

## Bridge Group Interface (Some Devices Only)

Some security devices support bridge group (bgroup) interfaces. Bgroup interfaces let you group multiple Ethernet and wireless interfaces together. Each bgroup interface constitutes its own broadcast domain and provides high-speed Ethernet switching between interfaces within the group. You can assign a single IP address to each bgroup interface. You can bind a bgroup interface to any zone.

For devices that are pre-configured with bridge group interfaces, there are two different bridge group numbering systems. On some devices, the pre-configured bgroup interfaces are identified as bgroup0 through bgroup3. On other devices the pre-configured bgroup interfaces are identified as bgroup0/0 through bgroup0/2.

On some devices that support field-installable physical interface modules, you can create bgroups containing some or all of the Ethernet ports on the module. On these devices, you create bgroups identified as bgroupx/y, where x is the slot number for the module containing the grouped ports and y is a number you assign when creating the bridge group.

### To Create a New bgroup Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, select Bgroup IF, click New, and then enter the required information:

Interface Name: Choose the slot number in which the PIM is installed, and enter a group number.

Zone Name: The name of the zone to which the interface is bound.

IP Address/Netmask: Enter the IP address and netmask of the interface.

Manageable: Select this option to enable management of the device using the interface IP address.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Path-MTU: Select this option to enable the device security device to send the source host an ICMP message when a packet size is too large.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they send the request again. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

Overbilling: (Some devices only) Enables the device to receive and send Overbilling Attack information through this interface.

Enforce-IPSEC: (Some devices only) Sets the interface to accept incoming connections only from an IPSec tunnel.

Maximum Transfer Unit (MTU): If the MTU of the network to which the interface connects is smaller than 1500 bytes (the default), enter that value here.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

### To Configure a bgroup Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, click Edit for the bridge group (bgroup) interface you want to configure, and then enter the necessary information:

Interface Name: (Read-only) The name of a physical interface is composed of the media type, slot number (for some devices), and port number, for example, ethernet3/2,ethernet2, bgroup0, or bgroup3/1.

Zone Name: The name of the zone to which the interface is bound.

Obtain IP using DHCP: (Some devices only) Select this option to enable the device to act as a DHCP client, receiving a dynamically assigned IP address for its interface from an ISP.

Automatic update DHCP server parameters: Select this check box to forward TCP/IP settings from the DHCP client module on the Untrust interface to the DHCP server module on the default interface in the Trust zone.

Obtain IP using PPPoE: (Some devices only) Select this option to enable the device to act as a PPPoE client, receiving an IP address for its interface from an Internet Service Provider (ISP).

Create new PPPoE setting: You can configure a new instance of PPPoE, which, once you save it, you can add to the Obtain IP using the PPPoE drop-down list.

Static IP: (Some devices only) Select this option to assign a unique and fixed IP address to the interface.

IP Address/Netmask: Enter the IP address and netmask of the interface.

Manageable: Select this option to enable management of the device using the interface IP address.

Manage IP: (Some devices only) The logical IP address through which you can manage the device. You can set a different Manage IP address on each available interface. The Manage IP address must be on the same subnet as the physical IP address.

Interface Mode: (Appears only when you enter and save a static IP address and netmask) Select NAT so that the IP addresses of the devices on this interface have private, nonroutable IP addresses. Select Route so that the IP addresses of the devices on this interface have public, routable IP addresses. NAT is the default mode.

Note: Interface-based NAT applies only to traffic sent to the Untrust zone. To use NAT for traffic sent to other zones, you must specify it in a policy.

For more information about operational modes, such as NAT, Route, or Transparent, see Operational Modes.

Block Intra-Subnet Traffic: (available only for tunnel interfaces with an IP address/netmask) Select this check box to block traffic that routes back out the same interface that it entered.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Path-MTU:

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they send the request again. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

Overbilling: (Some devices only) Enables the device to receive and send Overbilling Attack information through this interface.

Enforce-IPSEC: (Some devices only) Sets the interface to accept incoming connections only from an IPSec tunnel.

Maximum Transfer Unit (MTU): If the MTU of the network to which the interface connects is smaller than 1500 bytes (the default), enter that value here.

DNS Proxy: Select this option if you want the security device to proxy (forward) Domain Name Service (DNS) queries received on this interface to the appropriate DNS server as configured on the DNS Proxy Configuration page.

Note: The DNS Proxy option does not apply to Layer 2 interfaces.

W ebAuth: (Appears only when you enter and apply an IP address/netmask) Select this option to enable WebAuth authentication for this interface. Enter the IP address that receives authentication requests for the WebAuth server. The WebAuth IP address must be in the same subnet as the interface IP address.

SSL Only: Select this option to require that all WebAuth authentication requests use SSL. URLs must include https://, followed by the IP address that receives authentication requests for the WebAuth server (for example, https://ip_addr).

Traffic Bandwidth: The traffic bandwidth in kilobits per second (Kbps) that you assign to the interface.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

## Domain Name Service (DNS) Dialer Interface (Some Devices Only)

Some security devices support the dialer interface, identified as dialerx interface where x can range from 1 to 10. Use this method to dial out to multiple destinations, when the number of destinations exceeds the number of available physical lines.

The dialer interface uses a dialer pool to bind the physical interfaces. This separates the actual physical links from all the potential destinations. When the number of destinations exceeds the number of available physical lines, a physical interface can be configured as a member of a dialer pool. The physical interface can also belong to more than one pool, allowing the single line to be used to dial more than one destination.

To Configure a Dialer Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, select Dialer IF and click New. Then enter the necessary information:

Interface Name: The dialer interface name is identified as dialerx, where x is a number from 1 to 10.

Dialer Options

Primary/alternate number(s): The primary number provides a remote destination for the security device to call. If the primary number is not connected, the alternate number is used. The primary and alternate numbers can be any string length less than 32 characters.

Load threshold: This option provides additional bandwidth on demand. If you set this option and the traffic exceeds the load threshold you specified for one B-channel, then the second B-channel is utilized. The traffic is recalculated at an interval of 30 sec. The range for the B-channel load threshold is 1 to 100 (in percent). The default is 80 percent.

Idle time: Use this option to set the amount of time (in seconds) you want the device to wait for traffic before it drops the connection. The idle time can be set for 0 to 60000 seconds, where a setting of zero (0) means the connection cannot be idle. The default is 180 seconds.

Retry times: Use this option to set the number of attempts you want the security device to dial the phone number specified. If the call does not connect, the number is redialed (one to six times) the number of attempts specified. The default is three attempts.

Interval: Use this option to set the dial interval (in seconds) between redial attempts caused by no connection. You can specify 1 to 60 seconds; the default is 30 seconds.

Dialer pool: Use this option to identify the dialer pool that you want the dialer interface to use. The dialer pool identification can be any string length less than 32 characters. See Dialer Pool.

WAN Encapsulation:

None: Sets no encapsulation method.

PPP: Sets the WAN interface to use Point-to-Point Protocol as the encapsulation method.

Multi-link PPP: Sets the WAN interface to use multi-link Point-to-Point Protocol as the encapsulation method.

Binding a PPP Profile (appears after you select PPP or MLPPP encapsulation and click Apply): Select the PPP access profile.

Note: For an interface with PPP encapsulation, you must bind a PPP access profile to the interface. You must create a PPP access profile even if no authentication is used on the PPP data link. See PPP access profiles.

Zone Name: The name of the zone to which the interface is bound.

Fixed IP option:

IP Address/Netmask: Enter the IP Address and netmask of the interface.

Manageable: Select this option to enable management of the device using the interface IP address.

Manage IP: The logical IP address through which you can manage the device. You can set a different Manage IP address on each available interface. The Manage IP address must be on the same subnet as the physical IP address.

Unnumbered: Sets the WAN interface to use a unnumbered interface.

Interface: Selects the unnumbered interface.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they send the request again. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

Overbilling: (Some devices only) Enables the device to receive and send Overbilling Attack information through this interface.

Enforce-IPSEC: (Some devices only) Sets the interface to accept incoming connections only from an IPSec tunnel.

Maximum Transfer Unit (MTU): If the MTU of the network to which the interface connects is smaller than 1500 bytes (the default), enter that value here.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

## Basic Rate Interface (Some Devices Only)

Some security devices support the ISDN feature or the Basic Rate Interface (BRI) service. The BRI is also called 2B+D, because it consists of two 64 Kbps B-channels and one 16 Kbps D-channel. The B-channels are used for data, and the D-channel is responsible for carrying signaling traffic needed to establish and terminate connections between sites.

Each ISDN BRI uses the naming convention brix/0, where x=slot-id and x/0 represents slot-id/port-id. The two B-channels for bri0/0, for example, are identified as bri0/0.1 and bri0/0.2.

Use one of the following methods to configure your device for ISDN connectivity:

### To Configure the BRI as a dialer

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

Set up this ISDN configuration if you are dialing out to a single destination only, when you have intermittent traffic between two sites. The connection drops when there is no traffic.

To set up the ISDN Basic Rate Interface (BRI) as a dialer:

1. Select the ISDN switch type (Switch Type after Reboot option).

2. Create a PPP profile.

3. Set up the BRI as a dialer.

1. Check the Dial Using BRI option.

2. Enter the Primary Number to dial out.

3. Select the WAN Encapsulation.

4. Click Apply.

5. Bind the PPP profile.

4. Route traffic through the ISDN interface (BRI).

### To Configure the Dialer Interface as a dialer

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

Use this method to dial out to multiple destinations, when the number of destinations exceeds the number of available physical lines. This configuration supports dial-on-demand Routing (DDR) and bandwidth-on-demand.

To dial out, using the dialer interface as a dialer:

1. Select the ISDN switch type (Switch Type after Reboot option).

2. Create a PPP profile.

3. Set up the dialer interface.

1. Create a dialer interface and bind the PPP profile.

   1. On the Interface List page, select Dialer IF and click New.

   Interface Name: The dialer interface name is identified as dialerx, where x is a number from 1 to 10.

   Dialer Options:

   Primary/alternate number(s): The primary number provides a remote destination for the security device to call. If the primary number is not connected, the alternate number is used. The primary and alternate numbers can be any string length less than 32 characters.

   WAN Encapsulation:

   Multi-link PPP: Sets the WAN interface to use multi-link Point-to-Point Protocol as the encapsulation method.

   Binding a PPP Profile: This option appears after you select PPP or MLPPP encapsulation and click Apply.

   2. Click OK to save your changes and return to the Interface List. Click Apply to continue configuring the interface.

2. Create a dialer pool and bind the dialer pool to the dialer interface.

   1. On the Interface List page, select dialerx and click Edit.

   2. Create a dialer pool. Enter a pool name and click Add.

   3. On the Interface List page, select bri and click Edit.

   4. Select Dialer Pool.
      The Dialer Pool option appears only when both BRI Modes (Leased Line and Dial using BRI are unchecked. Click Apply.

   5. Set the priority for the dialer pool and check the Select as Member box.

   6. Click OK to save your changes and return to the Interface List. Click Apply to continue configuring the interface.

3. Add the ISDN Basic Rate interface (BRI) to the dialer pool (select a BRI as a pool member).

4. Route traffic through the dialer interface.

### To Configure the BRI for Leased Line

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

If the BRI is configured for leased-line mode, it becomes a Layer 3 interface that can only deliver data, so the D-channel is not required. Only one channel (B+B) with a total data rate of 128Kbps is supported.

Use this configuration method to connect two sites with a cost-effective and reliable, high-speed connection as and when required.

To dial out, using the BRI as a leased line:

1. Select the ISDN switch type (Switch Type after Reboot option).

2. Create a PPP profile.

3. Set up the BRI mode for Leased Line.

1. Check the Leased Line option.

2. Select the WAN Encapsulation.

3. Click Apply.

4. Bind the PPP profile.

4. Route traffic through the ISDN interface (BRI).

## Tunnel Interface

A tunnel interface acts as doorway to a VPN tunnel. Traffic enters and exits a VPN tunnel via a tunnel interface.

By binding a tunnel interface to a VPN, you can separate the policy from the VPN tunnel. This way, you can configure one tunnel, and define multiple policies to allow or deny traffic through that tunnel. When there is no tunnel interface bound to a VPN tunnel, you must specify a VPN tunnel in the access policy itself and choose tunnel as the action. Because the action tunnel implies permission, you cannot specifically deny traffic from a VPN tunnel.

You can perform policy-based NAT on outgoing or incoming traffic using a pool of dynamic IP (DIP) addresses in the same subnet as the tunnel interface.

For more information about tunnel interfaces and VPN tunnels, refer to the Concepts & Examples ScreenOS Reference Guide available on the documentation CD that shipped with your Juniper Networks product and also on the Juniper Networks Support site.

### To Configure a Tunnel Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, select Tunnel IF, click New, and then enter the required information:

Tunnel Interface Name: Enter an ID number for the tunnel interface.

Zone (VR): Select the zone and virtual router to which you want to bind the tunnel interface.

Fixed IP: Select this option if you want the tunnel interface to support policy-based NAT.

IP Address/Netmask: Enter the IP address and netmask of the tunnel interface.

Unnumbered: Select this option if the tunnel interface does not need to support policy-based NAT and if your configuration does not require the tunnel interface to be bound to a tunnel zone.

An unnumbered interface borrows the IP address from another interface that is bound to the same security zone. You must specify which interface the tunnel interface will borrow the IP address from.

Interface: Select the interface from which the tunnel interface will borrow the IP address. The interface must be in the same security zone as the tunnel interface.

Maximum Transfer Unit (MTU): If you know the MTU of the VPN data path and it is smaller than 1500 bytes (the default), enter that value here. The device first fragments a VPN-destined packet if the packet size exceeds the MTU on the outgoing physical interface. Then the device encapsulates and encrypts the fragment. (When the device fragments a packet, it reserves at least 200 bytes for encapsulation and encryption.) If the VPN data path requires a smaller MTU than 1500 bytes, intermediary network devices must defragment, reassemble, and again fragment oversized VPN packets as they receive them. Use this option to avoid adding such unnecessary strain to the network.

DNS Proxy: Select this option if you want the device to proxy (forward) Domain Name Service (DNS) queries received on this tunnel interface to the appropriate DNS server as configured on the DNS Proxy Configuration page.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

Block Intra-Subnet Traffic: (only available for tunnel interfaces with an IP address/netmask) Select this check box to block traffic that routes back out the same tunnel interface that it entered.

Note: For more information on tunnel interfaces, see Tunnel Interface Configuration.

## Domain Name Service (DNS) Redundant Interface

You can bind two physical interfaces together to create one redundant interface, which you can then bind to a security zone. One of the two physical interfaces acts as the primary interface and handles all the traffic directed to the redundant interface. The other physical interface acts as the secondary interface and stands by in case the active interface experiences a failure.

### To Configure a Redundant Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, select Redundant IF, click New, and then enter the necessary information:

Interface Name: Enter a number next to "redundant".

As Member of loopback group: (Appears only when you enter and apply an IP address/netmask)To allow the interface to use the MIP on the loopback interface, configure the interface as a member of the loopback interface group.

Members: (Read-Only) The name of the physical interfaces that are members of the redundant interface. You can assign physical interfaces to the redundant interface through the physical interface configuration.

Zone Name: Select the zone to which you want to bind the interface.

IP Address/Netmask: Enter the IP address and netmask of the redundant interface.

Manageable: Select this option to enable management of the device using the interface IP address.

Manage IP: (Appears only when you enter and apply an IP address/netmask)The logical IP address through which you can manage the device. You can set a different Manage IP address on each available interface. The Manage IP address must be on the same subnet as the physical IP address.

Interface Mode: (Appears only when you enter and save a static IP address and netmask) Select NAT so that the IP addresses of the devices on this interface have private, non-routable IP addresses. Select Route so that the IP addresses of the devices on this interface have public, routable IP addresses. NAT is the default mode.

Note: Interface-based NAT only applies to traffic sent to the Untrust zone. To use NAT for traffic sent to other zones, you must specify it in a policy.

For more information on operational modes, such as NAT, Route, or Transparent, see Operational Modes.

Block Intra-Subnet Traffic: (Appears only when you enter and apply an IP address/netmask) Select this check box to block traffic that routes back out the same interface that it entered.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they send the request again. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

Overbilling: (Appears only when you enter and apply an IP address/netmask on some security devices) Enables the device to receive and send Overbilling Attack information through this interface.

Enforce-IPSEC: (Appears only when you enter and apply an IP address/netmask on some security devices) Sets the interface to accept incoming connections only from an IPSec tunnel.

Maximum Transfer Unit (MTU): If the MTU of the network to which the interface connects is smaller than 1500 bytes (the default), enter that value here.

DNS Proxy: Select this option if you want the device to proxy (forward) Domain Name Service (DNS) queries received on this interface to the appropriate DNS server as configured on the DNS Proxy Configuration page.

W ebAuth: (Appears only when you enter and apply an IP address/netmask) Select this option to enable WebAuth authentication for this interface. Enter the IP address that receives authentication requests for the WebAuth server. The WebAuth IP address must be in the same subnet as the interface IP address.

SSL Only: Select this option to require that all WebAuth authentication requests use SSL. URLs must include https://, followed by the IP address that receives authentication requests for the WebAuth server (for example, https://ip_addr).

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

## Domain Name Service (DNS) VSI Interface

Virtual security interfaces (VSIs) are the virtual interfaces that two devices forming a virtual security device (VSD) share when operating in high availability (HA) mode. A VSI is bound to a VSD group so before you configure a VSI, you must first configure a VSD group. For more information, see VSD Group.

For more information about VSI interfaces, refer to the Concepts & Examples ScreenOS Reference Guide available on the documentation CD that shipped with your Juniper Networks product and also on the Juniper Networks Support site.

### To Configure a Virtual Security Interface

1. On the Interface List page, select VSI IF, click New, and then enter the necessary information:

Interface Name: Select an interface from the drop-down menu next to "VSI Base", and select a number from the drop-down menu next to "VSD Group".

As member of loopback group: (Appears only when you enter and apply an IP address/netmask) To allow the interface to use the MIP on the loopback interface, configure the interface as a member of the loopback interface group.

VSD Group: Select the VSD group to which the virtual security interface belongs.

IP Address/Netmask: Enter the IP address and netmask of the virtual security interface.

Manageable: Select this option to enable management of the device using the interface IP address.

Interface Mode: (Appears only when you enter and save a static IP address and netmask) Select NAT so that the IP addresses of the devices on this interface have private, non-routable IP addresses. Select Route so that the IP addresses of the devices on this interface have public, routable IP addresses. NAT is the default mode.

Note: Interface-based NAT only applies to traffic sent to the Untrust zone. To use NAT for traffic sent to other zones, you must specify it in a policy.

For more information on operational modes, such as NAT, Route, or Transparent, see Operational Modes.

Block Intra-Subnet Traffic: (Appears only when you enter and apply an IP address/netmask) Select this check box to block traffic that routes back out the same interface that it entered.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they send the request again. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

Overbilling: (Appears only for some security devices when you enter and apply an IP address/netmask) Enables the device to receive and send Overbilling Attack information through this interface.

Enforce-IPSEC: (Appears only for some security devices when you enter and apply an IP address/netmask) Sets the interface to accept incoming connections only from an IPSec tunnel.

Maximum Transfer Unit (MTU): If the MTU of the network to which the interface connects is smaller than 1500 bytes (the default), enter that value here.

DNS Proxy: Select this option if you want the device to proxy (forward) Domain Name Service (DNS) queries received on this interface to the appropriate DNS server as configured on the DNS Proxy Configuration page.

W ebAuth: (Appears only when you enter and apply an IP address/netmask) Select this option to enable WebAuth authentication for this interface. Enter the IP address that receives authentication requests for the WebAuth server. The WebAuth IP address must be in the same subnet as the interface IP address.

SSL Only: Select this option to require that all WebAuth authentication requests use SSL. URLs must include https://, followed by the IP address that receives authentication requests for the WebAuth server (for example, https://ip_addr).

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

## Domain Name Service (DNS) Sub-Interface (Some Devices Only)

A sub-interface, like a physical interface, acts as a doorway through which traffic enters and exits a security zone. You can logically divide a physical interface into several virtual sub-interfaces. Each virtual sub-interface borrows the bandwidth it needs from the physical interface from which it stems, thus its name is an extension of the physical interface name, for example, ethernet3/2.1 or ethernet2.1.

You can bind a sub-interface to any zone. You can bind a sub-interface to the same zone as its physical interface, or you can bind it to a different zone.

### To Configure a Sub-Interface

Note: The interface configuration options you see depend upon the device model and on certain configuration selections, such as the zone to which the interface is bound.

1. On the Interface List page, select Sub-IF, click New, and then enter the necessary information:

Interface Name: Select an interface from the drop-down menu, and enter a number after the period (.).

Zone Name: Select the zone to which you want to bind the interface.

IP Address/Netmask: Enter the IP address and netmask of the virtual security interface.

Manageable: Select this option to enable management of the device using the interface IP address.

VLAN Tag: Enter a VLAN tag number. A sub-interface is an abstraction that functions identically to an interface for a physically present port and is distinguished by 802.1Q VLAN tagging. The device directs traffic to and from a zone with a sub-interface via its IP address and VLAN tag. For convenience, administrators usually assign a VLAN tag that is the same as the interface number.

Interface Mode: (Appears only when you enter and save a static IP address/netmask and VLAN tag) Select NAT so that the IP addresses of the devices on this interface have private, non-routable IP addresses. Select Route so that the IP addresses of the devices on this interface have public, routable IP addresses. NAT is the default mode.

Note: Interface-based NAT only applies to traffic sent to the Untrust zone. To use NAT for traffic sent to other zones, you must specify it in a policy.

For more information on operational modes, such as NAT, Route, or Transparent, see Operational Modes.

Management Services:

WebUI: Select this option to enable management through the Web user interface (WebUI).

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

NSM: Select this option to allow the interface to receive NetScreen-Security Manager traffic.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they send the request again. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

DNS Proxy: Select this option if you want the device to proxy (forward) Domain Name Service (DNS) queries received on this interface to the appropriate DNS server as configured on the DNS Proxy Configuration page.

WebAuth IP: (Appears only when you enter and apply an IP address/netmask) Select this option to enable WebAuth authentication for this interface. Enter the IP address that receives authentication requests for the WebAuth server. The WebAuth IP address must be in the same subnet as the interface IP address.

SSL Only: Select this option to require that all authentication requests to the WebAuth authentication server use SSL. If this option is cleared, the WebAuth server responds to either HTTP (clear-text) or HTTPS (cipher-text) authentication requests.

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

## Domain Name Service (DNS) Aggregate Interface (Some Devices Only)

An aggregate interface is the cumulation of several physical interfaces, each of which shares the traffic load directed to the IP address of the aggregate interface equally among themselves. By using an aggregate interface, you can greatly increase the amount of bandwidth available to a single IP address.

### To Configure an Aggregate Interface

1. On the Interface List page, select Aggregate IF, click New, and then enter the necessary information:

Interface Name: Enter a number from 1 to 4 next to "aggregate".

Members: (Read-Only) The name of the two ports that are members of the aggregate-port interface. You assign ports to the aggregate-port interface through the physical interface configuration.

Note: To be available for port aggregation, both ports in a pair must be free (not bound to a zone). Also, note that each port can only be paired with one particular port. The legal pairs are: Ethernet2/1 Ethernet2/2; Ethernet2/3 Ethernet2/4; Ethernet2/5 Ethernet2/6; Ethernet2/7 Ethernet2/8.

Zone Name: The name of the zone to which the aggregate-port interface is bound.

IP Address/Netmask: Enter the IP address of the aggregate-port interface and the subnet mask for the subnet on which the aggregate-port interface IP address is located.

Manageable: Select this option to enable management of the security device using the interface IP address.

Manage IP: The logical IP address through which you can manage the security device. You can set a different Manage IP address on each available interface. The Manage IP address must be on the same subnet as the physical IP address.

Interface Mode: (Appears only when you enter and save a static IP address and netmask.) Select NAT so that the IP addresses of the devices on this interface have private, non-routable IP addresses. Select Route so that the IP addresses of the devices on this interface have public, routable IP addresses. NAT is the default mode.

Note: Interface-based NAT only applies to traffic sent to the Untrust zone. To use NAT for traffic sent to other zones, you must specify it in a policy.

For more information on operational modes, such as NAT, Route, or Transparent, see Operational Modes.

Management Services:

WebUI: Select to enable management through the Web user interface (WebUI).

Telnet: Select this option to allow management through a terminal emulation program for TCP/IP networks such as the Internet. Telnet is a common way to control a network device remotely.

SSL: Select this option to allow the interface to receive HyperText Transfer Protocol over Secure Sockets Layer (HTTPS) traffic for secure management of a device via the WebUI.

SNMP: Select this option to enable the use of Simple Network Management Protocol (SNMP. The device supports SNMP version 1 (SNMPv1), described in RFC-1157, and all relevant Management Information Base II (MIB II) groups defined in RFC-1213.

SSH: Select this option to enable management using a secure command shell (SSH). You can administer the device from an Ethernet connection or a dial-in modem using SSH.

Other Services:

Ping: Select this option to allow the device to respond to ICMP echo requests, or pings. A ping is a utility that determines if a specific IP address is accessible.

Ident-reset: Services like Mail and FTP send identification requests. If they receive no acknowledgment, they send the request again. While the request is processing, there is no user access. An ident-reset restores access that has been blocked by an unacknowledged identification request.

DNS Proxy: Select this option if you want the security device to proxy (forward) Domain Name Service (DNS) queries received on this interface to the appropriate DNS server as configured on the DNS Proxy Configuration page.

W ebAuth: (Appears only when you enter and apply an IP address/netmask) Select this option to enable WebAuth authentication for this interface. Enter the IP address that receives authentication requests for the WebAuth server. The WebAuth IP address must be in the same subnet as the interface IP address.

SSL Only: Select this option to require that all WebAuth authentication requests use SSL. URLs must include https://, followed by the IP address that receives authentication requests for the WebAuth server (for example, https://ip_addr).

2. Click OK to save your changes and return to the Interface List page. Click Apply to continue configuring the interface.

## Domain Name Service (DNS) Loopback Interface (Some Devices Only)

A loopback interface is a logical interface that emulates a physical interface on the device. A loopback interface is always in the up state as long as the device on which it resides is up. Like a physical interface, you must assign an IP address to a loopback interface and bind it to a security zone. You can define a mapped Internet Protocol (MIP) address on a loopback interface, which allows the MIP to be accessed by a group of interfaces.

For more information, see Loopback Interface Configuration.

## Mapped IP Addresses

Some interface configuration pages give you the option to create mapped Internet Protocol (MIP) addresses. To create MIP addresses for the interface, click MIP.

For more information, see Mapped IP Address Configuration.

## Virtual IP Addresses

Some interface configuration pages give you the option to create virtual Internet Protocol (VIP) addresses. To create VIP addresses for the interface, click VIP.

For more information, see Virtual IP Address List.

## Secondary IP Addresses

Some interface configuration pages give you the option to create secondary Internet Protocol addresses. To create secondary IP addresses for the interface, click Secondary IP.

For more information, see Secondary IP Address Configuration.

## Dynamic IP Addresses

Some interface configuration pages give you the option to create dynamic Internet Protocol (DIP) address pools. To create DIP address pools for the interface, click DIP.

For more information, see Dynamic IP Address Pool Configuration.

## BGP

Some interface configuration pages give you the option of configuring Border Gateway Protocol (BGP). To configure BGP for the interface, click BGP.

For more information, see BGP Virtual Router Settings.

## DHCP

Some interface configuration pages give you the option of configuring Dynamic Host Configuration Protocol (DHCP). To configure DHCP for the interface, click DHCP.

For more information, see DHCP Relay Agent or Server Configuration.

## RIP/RIPng

Some interface configuration pages give you the option of configuring Routing Information Protocol (RIP) or Routing Information Protocol Next Generation (RIPng). To configure RIP for an interface in an IPv4 environment, click RIP. To configure RIPng for an interface in an IPv6 environment, click RIPng.

For more information, see RIP Interface Configuration or RIPng Interface Configuration

## OSPF

Some interface configuration pages give you the option of configuring Open Shortest Path First (OSPF). To configure OSPF for the interface, click OSPF.

For more information, see OSPF Interface Configuration.