System Management

This chapter includes procedures and reference information for system management tasks.

Time

All Security Gateways, Security Management Servers and cluster members must synchronize their system clocks. This is important for these reasons:

• SIC trust can fail if devices are not synchronized correctly.
• Cluster synchronization requires precise clock synchronization between members.
• SmartEvent correlation uses time stamps that must be synchronized to approximately one a second.
• To make sure that cron jobs run at the correct time.
• To do certificate validation for applications based on the correct time.

You can use these methods to set the system date and time:

• Network Time Protocol (NTP).
• Manually, using the WebUI or the CLI.

Network Time Protocol (NTP)

Network Time Protocol (NTP) is an Internet standard protocol used to synchronize the clocks of computers in a network to the millisecond.

NTP runs as a background client program on a client computer. It sends periodic time requests to specified servers to synchronize the client computer clock. We recommend that you configure more than one NTP server for redundancy.

Setting the Time and Date - WebUI

To set time and date automatically using NTP:

1. In the WebUI tree, click System Management > Time.
2. Click Set Time and Date.
3. In the Time and Date Settings window, select Set Time and Date automatically using Network Time Protocol (NTP).
4. Enter the URL or IP address of the primary and (optionally) secondary NTP servers.
5. Select the NTP version for the applicable server.
6. Click OK.

To set the system time and date:

1. In the tree view, click System Management > Time.
2. Click Set Time and Date.
3. Enter the time and date in the applicable fields.
4. Click OK.

To set the time zone:

1. In the tree view, click System Management > Time.
2. Click Set time Zone and select the time zone from the list.
3. Click OK.

Configuring NTP - CLI (ntp)

NTP

show ntp active

show ntp current

show ntp servers

set ntp active [On|Off]

set ntp server primary VALUE version VALUE

set ntp server secondary VALUE version VALUE

delete ntp server <IP>

IP Address               Type              Version

pool.ntp.org             Primary           4

Showing the Time & Date - CLI (clock)

Clock

Setting the Date - CLI (date)

Date

Setting the Time - CLI (Time)

Time

Setting the Time Zone - CLI (timezone)

Time Zone

set timezone <Area> / <Region>

show timezone

Cloning Groups

A Cloning Group is a collection of Gaia gateways that synchronize their OS configurations and settings for a number of these shared features:

• SNMP
• Banner Messages
• Job Scheduler
• DNS
• ARP
• System Logging
• Host Access Control
• Proxy Settings
• Host Address Assignment
• NTP
• Password Policy
• Time
• Network Access
• Display Format
• Mail Notification
• Inactivity Timeout
• Users and Roles
• Static Routes
• DHCP Relay
• BGP
• IGMP
• PIM
• Static Multicast Routes
• RIP
• OSPF
• IPv6 OSPF
• Route Aggregation
• Inbound Route Filters
• Route Redistribution
• Route Map
• Routing Options
• Policy Based Routing

A configuration change in one of the members is automatically propagated to other members. This is useful in ClusterXL. If the ClusterXL members are also members of a Cloning Group, static routes can be synchronized.

You can:

• Manually define an independent Cloning Group through the Gaia WebUI. To do this, use Manual mode. In manual mode, the administrator creates the Cloning Group and separately adds each member.
• Configure a ClusterXL cluster as a Gaia Cloning Group. To do this, use ClusterXL mode. All the ClusterXL members become members of the same Cloning Group.

  Note: a VRRP Cluster has to be manually defined.

Important: Synchronization between members of a Cloning Group requires TCP Port 1129 to be open and communication through the port allowed by the firewall. When the gateways are part of a cluster in SmartDashboard, an implied rule in the rule base allows this connection. When the gateways are not part of the same Cluster, the implied rule does not apply. If the gateways are not part of the same cluster object in SmartDashboard, make sure there is a rule that allows connections on TCP port 1129.

Configuring Cloning Groups - WebUI

Cloning Groups are configured from the gateway WebUI.

To create a new Cloning Group:

1. Open the Gaia gateway WebUI.
2. In System Management > Cloning Group, click Start Cloning Group Creation Wizard.

   The Cloning Group Creation Wizard opens.

3. Select Create a new Cloning Group.

   The New Gaia Cloning Group window opens.

   • Enter a name for the Cloning Group
   • Select an IP address for synchronizing settings between member gateways. Select an address on a secure internal network.
   • Enter a password for the administration account (cadmin). This password is necessary to:
     • Manage the Cloning Group
     • Add other gateways to the Cloning Group
     • Create encrypted traffic between members of the Cloning Group
4. In the Shared Features screen, select features to clone to other members of the group.

   Pay attention to which features you want to clone. For example, you might not want to clone static routes to gateways that are members of a cluster.

5. Click Next for the Wizard Summary and then click Finish.

To manage the Cloning Group:

1. Sign out of the WebUI
2. Sign in to the same WebUI using the cadmin account and password.

   (Alternatively, log in to the gateway command line using the cadmin credentials.)

   Important: No unique URL or IP address is needed to access the Cloning Group WebUI or clish command line. Use the URL or IP address of the member gateway.

3. In System Management > Cloning Group, select features from the Shared Features.
4. Click Set Shared Features.

   The shared features are propagated to all members of the group. If, for example, you then configure a primary DNS server on one member of the Cloning Group, and DNS is one of the Shared Features, then the DNS settings are propagated to all members of the group. The DNS settings in the WebUI of each member are grayed out.

To join a Cloning Group:

1. Open the Gaia gateway WebUI.
2. In System Management > Cloning Group, click Start Cloning Group Creation Wizard.

   The Cloning Group Wizard opens.

3. Select Join an existing Cloning Group.
4. The Join Existing Cloning Group window opens.
   • Enter the IP address of a remote member of the Cloning Group.
   • Select an IP address for synchronizing the settings between gateways. Select a secure internal address.
   • Enter the password of the Cloning Group administration account (cadmin). (The same password you entered when creating the group.) The cadmin password:
     • Lets you log in to the cadmin account
     • Is used to create authentication credentials for members during synchronization
5. Click Next for the Wizard Summary and then click Finish.

To create a Cloning Group that follows ClusterXL:

Select this option if the gateway is a member of a ClusterXL.

Note: If you select this option, you have to select it for all the members of the cluster.

1. Open the Gaia WebUI.
2. In System Management > Cloning Group, click Start Cloning Group Creation Wizard.

   The Cloning Group Creation Wizard opens.

3. Select Cloning Group follows ClusterXL.
   • Enter the Cloning Group name.
   • Enter a password for the Cloning Group administration account (cadmin).
4. Click Next for the Wizard Summary and then click Finish.
5. Repeat steps 1-4 for all members of the cluster.

Configuring Cloning Groups - CLI (Cloning Groups)

Cloning Groups can also be managed in clish command line interface. When run from the cadmin account, these commands apply to all members of the group.

You can create Cloning Groups in manual or in ClusterXL mode.

To create the first Cloning Group member in manual mode:

1. Set the cloning group mode to manual
2. Set the cloning group local-ip
3. Set the cloning group password
4. Set the cloning group state to: on
5. Optional: set a name for the Cloning Group

To add other gateways to the Cloning Group in manual mode:

On each of those gateways:

1. Set the cloning group mode to manual
2. Set the cloning group local ip
3. Set the cloning group password
4. Run the join cloning group command to join the group

To create Cloning Group members in ClusterXL mode:

On all member gateways:

1. Set the cloning group mode to ClusterXL
2. Set the cloning group password
3. Set the cloning group state to: on

To set up a Cloning Group:

Run this command: set cloning-group {local-ip <IPv4_address> | mode <manual|cluster-xl> | name <Cloning Group_name> | password | state <on|off>}

To add Shared Features

Run this command: add cloning-group shared-feature <feature>

To delete Shared Features

Run this command: delete cloning-group shared feature <feature>

To join a Cloning Group:

Run this command: join cloning-group remote-ip <IPv4_address>

To remove a member from a Cloning Group:

On the member gateway, run this command: leave cloning-group

To view Cloning Group Attributes:

Run this command: show cloning-group {local-ip | members | mode | name | shared-feature | state | status}

To re-synchronize a Cloning Group:

On a member gateway, run this command: re-synch cloning-group

SNMP

Simple Network Management Protocol (SNMP) is an Internet standard protocol. SNMP is used to send and receive management information to other network devices. SNMP sends messages, called protocol data units (PDUs), to different network parts. SNMP-compliant devices, called agents, keep data about themselves in Management Information Bases (MIBs) and resend this data to the SNMP requesters.

Through the SNMP protocol, network management applications can query a management agent using a supported MIB. The Check Point SNMP implementation lets an SNMP manager monitor the system and modify selected objects only. You can define and change one read‑only community string and one read‑write community string. You can set, add, and delete trap receivers and enable or disable various traps. You can also enter the location and contact strings for the system.

To view detailed information about each MIB that the Check Point implementation supports:

The Check Point implementation also supports the User‑based Security model (USM) portion of SNMPv3.

The Gaia implementation of SNMP is built on net-snmp 5.4.2.1. Changes have been made to the first version to address security and other fixes. For more information, see Net-SNMP.

SNMP, as implemented on Check Point platforms enables an SNMP manager to monitor the device using GetRequest, GetNextRequest, GetBulkRequest, and a select number of traps. The Check Point implementation also supports using SetRequest to change these attributes: sysContact, sysLocation, and sysName. You must configure read-write permissions for set operations to work.

SNMP on Check Point platforms, supports SNMP v1, v2, and v3.

Use Gaia to run these tasks:

• Define and change one read-only community string.
• Define and change one read-write community string.
• Enable and disable the SNMP daemon.
• Create SNMP users.
• Change SNMP user accounts.
• Add or delete trap receivers.
• Enable or disable the various traps.
• Enter the location and contact strings for the device.

V3 - User-Based Security Model (USM)

Gaia supports the user-based security model (USM) component of SNMPv3 to supply message-level security. With USM (described in RFC 3414), access to the SNMP service is controlled on the basis of user identities. Each user has a name, an authentication pass phrase (used for identifying the user), and an optional privacy pass phrase (used for protection against disclosure of SNMP message payloads).

The system uses the MD5 hashing algorithm to supply authentication and integrity protection and DES to supply encryption (privacy). Best Practice - Use authentication and encryption. You can use them independently by specifying one or the other with your SNMP manager requests. The Gaia system responds accordingly.

SNMP users are maintained separately from system users. You can create SNMP user accounts with the same names as existing user accounts or different. You can create SNMP user accounts that have no corresponding system account. When you delete a system user account, you must separately delete the SNMP user account.

Enabling SNMP

The SNMP daemon is disabled by default. If you choose to use SNMP, enable and configure it according to your security requirements. At minimum, you must change the default community string to something other than public. It is also advised to select SNMPv3, rather than the default v1/v2/v3, if your management station supports it.

You can choose to use all versions of SNMP (v1, v2, and v3) on your system, or to grant SNMPv3 access only. If your management station supports v3, select to use only v3 on your Gaia system. SNMPv3 limits community access. Only requests from users with enabled SNMPv3 access are allowed, and all other requests are rejected.

SNMP Agent Address

An agent address is a specified IP address at which the SNMP agent listens and reacts to requests. The default behavior is for the SNMP agent to listen to and react to requests on all interfaces. If you specify one or more agent addresses, the system SNMP agent listens and responds only on those interfaces.

You can use the agent address as a different method to limit SNMP access. For example: you can limit SNMP access to one secure internal network that uses a specified interface. Configure that interface as the only agent address.

SNMP Traps

Managed devices use trap messages to report events to the network management station (NMS). When some types of events occur, the platform sends a trap to the management station.

The Gaia proprietary traps are defined in GaiaTrapsMIB.mib in the /etc/snmp directory.

Gaia supports these types of traps:

Configuring SNMP - WebUI

To enable SNMP:

1. In the tree view, click System Management > SNMP.
2. Select Enable SNMP Agent.
3. In Version drop down list, select the version of SNMP to run:
   • 1/v2/v3 (any)

     Select this option if your management station does not support SNMPv3.

   • v3-Only

     Select this option if your management station supports v3. SNMPv3 provides a higher level of security than v1 or v2.

4. In SNMP Location String, enter a string that contains the location for the system. The maximum length for the string is 128 characters. That includes letters, numbers, spaces, special characters. For example: Bldg 1, Floor 3, WAN Lab, Fast Networks, Speedy, CA
5. In SNMP Contact String, enter a string that contains the contact information for the device. The maximum length for the string is 128 characters. That includes letters, numbers, spaces, special characters. For example: John Doe, Network Administrator, (111) 222‑3333
6. Click Apply.

To set an SNMP agent interface (Version R77.10 and higher):

1. In the tree view, click System Management > SNMP.

   The SNMP Addresses table shows the applicable interfaces and their IP addresses.

2. Select the header row checkbox to select all or select individual interfaces.

To set an SNMP agent address (Version R77 and earlier):

1. In the tree view, click System Management > SNMP.

   The SNMP Addresses table shows the applicable interfaces and their IPv4 addresses.

2. Select the header row checkbox to select all or select individual IPv4 addresses.

To configure the community strings:

1. In the V1/V2 Settings section, in Read Only Community String, set a string other than public. This is a basic security precaution that you must always use.
2. (Optional). Set a Read-Write Community String.

   Warning - Set a read-write community string only if you have reason to enable set operations, and if your network is secure.

To add a USM user:

1. In the tree view, click System Management > SNMP.
2. Below V3 - User-Based Security Model (USM), click Add. The Add New USM User window opens.
3. In User Name, The range is 1 to 31 alphanumeric characters with no spaces, backslash, or colon characters. This can be the same as a user name for system access.
4. In Security Level, select from the drop down list:
   • authPriv—The user has authentication and privacy pass phrases and can connect with privacy encryption.
   • authNoPriv—The user has only an authentication pass phrase and can connect only without privacy encryption.
5. In User Permissions, select the privileges for the user:
   • Read-only
   • Read-write
6. In Authentication Pass Phrase, enter a password for the user that is between 8 and 128 characters in length.
7. In Privacy Pass Phrase, enter a pass phrase that is between 8 and 128 characters in length. Used for protection against disclosure of SNMP message payloads.
8. Click Save. The new user shows in the table.

To delete a USM user

1. In the tree view, click System Management > SNMP.
2. Below V3 - User-Based Security Model (USM), select the user and click Remove. The Deleting USM User Entry window opens.
3. The window shows this message: Are you sure you want to delete "username" entry? Click Yes.

To edit a USM user:

1. In the tree view, click System Management > SNMP.
2. Below V3 - User-Based Security Model (USM), select the user and click Edit. The Edit USM User window opens.
3. In the window you can change the Security Level, User Permissions, the Authentication Passphrase, or the Privacy Passphrase.
4. Click Save.

To enable or disable trap types:

1. In the tree view, click System Management > SNMP.
2. In the Enabled Traps section, click Set. The Add New Trap Receiver window opens.
   • To enable a trap: Select from the Disabled Traps list, and click Add>
   • To disable a trap: Select from the Enabled Traps list, and click Remove>
3. Click Save.
4. Add a USM user. You must do this even if using SNMPv1 or SNMPv2. In Trap User, select an SNMP user.
5. In Polling Frequency, specify the number of seconds between polls.
6. Click Apply.

To configure trap receivers (management stations):

1. In the tree view, click System Management > SNMP.
2. In the Trap Receivers Settings section, click Add. The Add New Trap Receiver window opens.
3. In IPv4 Address, enter the IP address of a receiver.
4. In Version, Select the Trap SNMP Version for the trap receiver from the drop down menu.
5. In Community String, enter the community string for the specified receiver.
6. Click Save.

To edit trap receivers:

1. In the tree view, click System Management > SNMP.
2. In the Trap Receivers Settings section, select the trap and click Edit. The Edit Trap Receiver window opens.
3. You can change the Version or the community string.
4. Click Save.

To delete trap receivers:

1. In the tree view, click System Management > SNMP.
2. In the Trap Receivers Settings section, select the trap and click Remove. The Deleting Trap Receiver Entry window opens.
3. The window shows this message: Are you sure you want to delete "IPv4 address" entry? Click Yes.

Configuring SNMP - CLI (snmp)

set snmp agent VALUE

set snmp agent-version VALUE

set snmp location VALUE

set snmp contact VALUE

show snmp agent

show snmp agent-version

show snmp location

show snmp contact

delete snmp location

delete snmp contact

add snmp interface <IF_name> (for version R77.10 and higher)

add snmp address <IP_address> (for version R77 and earlier)

set snmp community VALUE read-only

set snmp community VALUE read-write

show snmp address

show snmp community

delete snmp address VALUE

delete snmp community VALUE

add snmp usm user VALUE security-level authNoPriv

ss-phrase
VALUE

add snmp usm user VALUE security-level authPriv 
auth-pass-phrase VALUE privacy-pass-phrase VALUE

add snmp usm user VALUE security-level authNoPriv 
auth-pass-phrase-hashed VALUE

show configuration snmp

add snmp usm user VALUE security-level authPriv

add snmp usm user VALUE security-level authPriv 
auth-pass-phrase hashed VALUE privacy-pass-phrase-hashed VALUE

show configuration snmp

set snmp usm user VALUE security-level authNoPriv 
auth-pass-phrase VALUE

set snmp usm user VALUE security-level authPriv 
auth-pass-phrase VALUE privacy-pass-phrase VALUE

set snmp usm user VALUE security-level authPriv 
privacy-pass-phrase VALUE auth-pass-phrase VALUE

set snmp usm user VALUE usm-read-only

set snmp usm user VALUE usm-read-write

show snmp usm user VALUE

show snmp usm users

delete snmp usm user VALUE

add snmp traps receiver VALUE version v1 community VALUE

add snmp traps receiver VALUE version v2 community VALUE

add snmp traps receiver VALUE version v3

set snmp traps receiver VALUE version v1 community VALUE

set snmp traps polling-frequency VALUE

set snmp traps receiver VALUE version v2 community VALUE

set snmp traps receiver VALUE version v3

set snmp traps trap VALUE disable

set snmp traps trap VALUE enable

set snmp traps trap-user VALUE

show snmp traps enabled-traps

show snmp traps polling-frequency

show snmp traps receivers

show snmp traps trap-user

delete snmp traps polling-frequency

delete snmp traps receiver VALUE

delete snmp traps trap-user

Parameters

snmp interface

community <c_name> read-only

show snmp traps enabled-traps

authorizationError

Interpreting Error Messages

This section lists and explains certain common error status values that can appear in SNMP messages. Within the PDU, the third field can include an error-status integer that refers to a specific problem. The integer zero (0) means that no errors were detected. When the error field is anything other than 0, the next field includes an error-index value that identifies the variable, or object, in the variable-bindings list that caused the error.

The following table lists the error status codes and their meanings.

The subsequent, or fourth field, contains the error index when the error-status field is nonzero, that is, when the error-status field returns a value other than zero, which indicates that an error occurred. The error-index value identifies the variable, or object, in the variable-bindings list that caused the error. The first variable in the list has index 1, the second has index 2, and so on.

The next, or fifth field, is the variable-bindings field. It consists of a sequence of pairs; the first is the identifier. The second element is one of these options: value, unSpecified, noSuchOjbect, noSuchInstance, or EndofMibView. The following table describes each element.

GetRequest

The following table lists possible value field sets in the response PDU or error-status messages when performing a GetRequest.

GetNextRequest

The only values that can be returned as the second element in the variable-bindings field to a GetNextRequest when an error-status code occurs are unSpecified or endOfMibView.

GetBulkRequest

The GetBulkRequest minimizes the number of protocol exchanges and lets the SNMPv2 manager request that the response is large as possible.

The GetBulkRequest PDU has two fields that do not appear in the other PDUs: non-repeaters and max-repetitions. The non-repeaters field specifies the number of variables in the variable-bindings list for which a single-lexicographic successor is to be returned. The max-repetitions field specifies the number of lexicographic successors to be returned for the remaining variables in the variable-bindings list.

If at any point in the process, a lexicographic successor does not exist, the endofMibView value is returned with the name of the last lexicographic successor, or, if there were no successors, the name of the variable in the request.

If the processing of a variable name fails for any reason other than endofMibView, no values are returned. Instead, the responding entity returns a response PDU with an error-status of genErr and a value in the error-index field that is the index of the problem object in the variable-bindings field.

Job Scheduler

You can use WebUI to access cron and schedule regular jobs. You can configure the jobs to run at the dates and times that you specify, or at startup.

Configuring Job Scheduler - WebUI

To schedule jobs:

1. In the tree view, click System Management > Job Scheduler.
2. Click Add. The Add A New Scheduled Job window opens.
3. In Job Name, enter the name of the job. Use alphanumeric characters only, and no spaces.
4. In command to Run, enter the name of the command. The command must be a UNIX command.
5. Below Schedule, select the frequency (Daily, Weekly, Monthly, At startup) for this job. Where relevant, enter the Time of day for the job, in the 24 hour clock format.
6. Click OK. The job shows in the Scheduled Jobs table.
7. In E-mail Notification, enter the email to receive the notifications.

   Note - You must also configure a Mail Server.

8. Click Apply.

To delete scheduled jobs

1. In the tree view, click System Management > Job Scheduler.
2. In the Scheduled Jobs table, select the job to delete.
3. Click Delete.
4. Click OK to confirm, or Cancel to abort.

To edit the scheduled jobs:

1. In the tree view, click System Management > Job Scheduler.
2. In the scheduled Jobs table, select the job that you want to edit.
3. Click Edit. The Edit Scheduled Job opens.
4. Enter the changes.
5. Click Ok.

Configuring Job Scheduler - CLI (cron)

add cron job VALUE command VALUE recurrence daily time VALUE

add cron job VALUE command VALUE recurrence monthly month VALUE days VALUE time VALUE

add cron job VALUE command VALUE recurrence weekly days VALUE time VALUE

add cron job VALUE command VALUE recurrence system-startup

delete cron all

delete cron job VALUE

delete cron mailto

set cron job VALUE command VALUE

set cron job VALUE recurrence daily time VALUE

set cron job VALUE recurrence monthly month VALUE days VALUE time VALUE

set cron job VALUE recurrence weekly days VALUE time VALUE

set cron job VALUE recurrence system-startup

set cron mailto VALUE

show cron job VALUE command

show cron job VALUE recurrence

show cron jobs

show cron mailto

Parameters

job

Mail Notification

Mail notifications (also known as Mail Relay) allow you to send email from the Security Gateway. You can send email interactively or from a script. The email is relayed to a mail hub that sends the email to the final recipient.

Mail notifications are used as an alerting mechanism when a Firewall rule is triggered. It is also used to email the results of cron jobs to the system administrator.

Gaia supports these mail notification features:

• Presence of a mail client or Mail User Agent (MUA) that can be used interactively or from a script.
• Presence of a Sendmail-like replacement that relays mail to a mail hub by using SMTP.
• Ability to specify the default recipient on the mail hub.

Gaia does not support these mail notification features:

• Incoming email.
• Mail transfer protocols other than outbound SMTP.
• Telnet to port 25.
• Email accounts other than admin or monitor.

Configuring Mail Notification - WebUI

To configure mail notifications recipient:

1. In the tree view, click System Management > Mail Notification.
2. In The Mail Server field, enter the server. For example: mail.example.com
3. In the User Name field, enter the user name. For example: user@mail.example.com
4. Click Apply.

Configuring Mail Notification - CLI (mail-notification)

set mail-notification server VALUE

set mail-notification username VALUE

show mail-notification server

show mail-notification username

show mail-notification server

Mail notification server: mail.company.com

Messages

You can configure Gaia to show a Banner Message and a Message of the Day to users when they log in.

Configuring Messages - WebUI

To configure messages:

1. In the tree view, click System Management > Messages.
2. To enter a Banner message, select Banner message.
3. To enter a Message of the day, select Message of the day.
4. Enter the messages.
5. Click Apply.

Configuring Messages - CLI (message)

Description

Set or show a banner message or a message of the day.

Syntax and Examples

To define a new banner message or message of the day:

set message banner <on|off> msgvalue <banner>

set message motd <on|off> msgvalue <message>

Examples:

set message banner on msgvalue "This system is private and confidential"

set message motd on msgvalue "Hi all- no changes allowed today"

To enable or disable the banner message:

set message banner on

set message banner off

To enable or disable the message of the day:

set message motd on

set message motd off

To show the messages:

show message all

show message banner

show message motd

To show if the messages are enabled or disabled:

show message all status

show message banner status

show message motd status

To delete the messages:

The delete command deletes the user defined message, not the default message. To prevent a message being shown, turn off the message.

1. Delete the configured message

   delete message banner
delete message motd

   This deletes the configured messages, and replace them with the default messages.

2. Disable the default messages:

   set message banner off
set message motd off

To make multi-line banner message or message of the day:

You can add a line to an existing message. If you delete the message, all lines are deleted, and replaced with the default message. To add a line to an existing message:

set message banner on line msgvalue <message> 

set message motd on line msgvalue <message> 

Examples:

set message banner on line msgvalue Welcome

set message motd on line msgvalue "System maintenance today"

Session

Manage inactivity timeout (in minutes) for the command line shell and for the WebUI.

Configuring the Session - WebUI

1. In the tree view, click System Management > Session.
2. Configure the Inactivity Timeout for the Command Line Shell.
3. Configure the Inactivity Timeout for the WebUI.

Configuring the Session - CLI (inactivity-timeout)

set inactivity-timeout VALUE

show inactivity-timeout

inactivity-timeout

Core Dumps

A Gaia core dump consists of the recorded status of the working memory of the Gaia computer at the time that a Gaia process terminated abnormally.

When a process terminates abnormally, it produces a core file in the /var/log/dump/usermode directory.

If the /log partition has less than 200 MB, no dumps are created, and all dumps are deleted to create space. This prevents core dumps filling the /log partition.

Configuring Core Dumps - WebUI

To configure core dumps, enable the feature and then configure parameters.

To configure core dumps:

1. Open the System Management > Core Dumps page.
2. Configure the Core Dump parameters.
3. Click Apply.

Core Dump Parameters

Configuring Core Dumps -CLI (core-dump)

set core-dump enable

set core-dump disable

set core-dump total VALUE

set core-dump per_process VALUE

show core-dump total

show core-dump per_process

total VALUE

per_process VALUE

System Configuration

Before you can configure IPv6 addresses and IPv6 static routes on a Gaia Security Management Server or Security Gateway you must:

1. Enable IPv6 support for the Gaia operating system and Firewall.
2. On the Security Management Server, install and enable an IPv6 license.
3. Create IPv6 objects in SmartDashboard.
4. Create IPv6 Firewall rules in SmartDashboard.

Configuring IPv6 Support - WebUI

1. In the WebUI tree view, click System Management > System Configuration.
2. In the IPv6 Support area, click On.
3. Click Apply.