fw up_execute

Description

Executes the offline Unified Policy.

This command only supports:

  • Source IP address, Destination IP address, and objects that contain an IP address

  • Simple services objects (based on destination port, source port, and protocol)

  • Protocol detection

  • Application detection

These are not supported:

  • Implied rules

  • All other objects are not supported (Security Zone, Access Roles, Domain Objects, Updatable Objects, Dynamic Objects, Other/DCERPC service, Content awareness, VPN, Resource, Mobile Access application, Time Objects, and so on)

Syntax

fw [-d] up_execute ipp=<IANA Protocol Number> [src=<Source IP>] [dst=<Destination IP>] [sport=<Source Port>] [dport=<Destination Port>] [protocol=<Protocol Detection Name>] [application=<Application/Category Name 1> [application=<Application/Category Name 2> ...]]

Parameters

Parameter

Description

No Parameters

Shows the built-in usage.

-d

Runs the command in debug mode.

Use only if you troubleshoot the command itself.

Best Practice - If you use this parameter, then redirect the output to a file, or use the script command to save the entire CLI session.

ipp=<IANA Protocol Number>

IANA Protocol Number in the Hexadecimal format.

Important - This parameter is always mandatory.

For example:

  • TCP = 6

  • UDP = 17

  • ICMP = 1

See IANA Protocol Numbers.

src=<Source IP>

Source IP address.

dst=<Destination IP>

Destination IP address.

sport=<Source Port>

Source Port number in the Decimal format.

See IANA Service Name and Port Number Registry.

dport=<Destination Port>

Destination Port number in the Decimal format.

Important - This parameter is mandatory for the TCP (6) and UDP (17) protocols.

See IANA Service Name and Port Number Registry.

protocol=<Protocol Detection Name>

Protocol detection name.

For example:

  • TCP

  • UDP

  • ICMP

  • HTTP

See IANA Protocol Numbers.

application=<Application/Category Name>

Name of the Application/Category as defined in SmartConsole.

You can specify multiple applications.

Example 1

[Expert@MyGW:0]# fw up_execute src=126.200.49.240 dst=10.1.1.1 ipp=1
 
Rulebase execution ended successfully.
Overall status:
----------------
Active clob mask: 0
Required clob mask: 0
Match status: MATCH
Match action: Accept
 
Per Layer:
------------
Layer name: Network
Layer id: 0
Match status: MATCH
Match action: Accept
Matched rule: 2
Possible rules: 2 16777215
 
[Expert@MyGW:0]#

Example 2

[Expert@MyGW:0]# fw up_execute src=10.1.1.1 ipp=6 dport=8080 protocol=HTTP application=Facebook application=Opera
 
Rulebase execution ended successfully.
Overall status:
----------------
Active clob mask: 0
Required clob mask: 0
Match status: MATCH
Match action: Accept
 
Per Layer:
------------
Layer name: Network
Layer id: 0
Match status: MATCH
Match action: Accept
Matched rule: 2
Possible rules: 2 16777215
 
[Expert@MyGW:0]#