access - Manage remote accesses to the appliance
[1] access [web [raz | (add (internal | auxiliary | vpnipsec | admin | antivirus | file | mon | rweb | web) <ip> [<network-mask> [<qos%>]]) | (del <ip> <network-mask>)]]
[2] access [admin [raz | (add | del) (internal | external | auxiliary | vpnipsec) <ip> [<network-mask>]]]
[3] access [mon [raz | (add | del) (internal | external | auxiliary | vpnipsec) (<ip> | <name>)]]
[4] access [file [raz | ((add (internal | external | auxiliary | vpnipsec) (<ip> | <name>) [(ftp | sftp) <login> [<password>]]) | (del (<ip> | <name>)))]]
[5] access [antivirus [raz | (add (internal | external | auxiliary | vpnipsec) <ip> [<network-mask> [<qos%>]]) | (del <ip> <network-mask>)]]
[6] access [manager [raz | (add (master | backup) (internal | external | auxiliary) <ip> "<manager-public-ssh-key>") | (del (master | backup))]]
[7] access [fweb [raz | (add | del) <ip> [<network-mask>]]]
This command is used to get or set access policies for traffic exchanged with the appliance itself, as opposed to traffic routed through it. To configure access policies for routed traffic, refer to the firewall command.
The first [1] usage form defines the networks that are allowed to directly access the appliance as a web browsing gateway (i.e. as a web proxy), via a specified network interface. Traffic bandwidth can also be customised per network using the optional <qos%> parameter. The <qos%> value is a percentage of the ingress or egress bandwidth allocated to web traffic and must be an integer between 1 and 100. The ingress and egress bandwidth values to which this percentage is applied are defined as follows:
• For accesses allowed via the native internal network interface or 802.1q pseudo network interfaces in vlan mode (web, rweb...), the ingress and egress bandwidths are defined with the command usage form qos shape web internal.
• For accesses allowed via the auxiliary network interface, the ingress and egress bandwidths are defined with the command usage form qos shape web auxiliary.
If no <qos%> value is specified, a default value of 100% is used. If a <qos%> value is specified for the vpnipsec interface, it is ignored, as IPsec VPN traffic flows through encrypted tunnels and therefore cannot be identified for the purpose of applying traffic shaping.
If no web access entry is defined, all networks located behind all interfaces except the external interface are allowed to access the web with a QoS of 100%. If at least one web access entry is defined, only explicitly defined networks are allowed to use the appliance as a forwarding proxy via the specified network interface.
When vlan mode is activated (see the mode command), it is possible to specify an explicit 802.1q pseudo interface instead of the internal interface. Allowed 802.1q pseudo interfaces are admin, antivirus, file, mon, rweb and web. It is recommended to always use 802.1q pseudo interfaces even when vlan mode is disabled, so that enabling vlan mode later does not require rewriting web access rules. When vlan mode is activated, the web interface replaces the internal interface in all web access rules.
The <qos%> value applies to all IP addresses belonging to a web access network. The effective <qos%> for a given IP address depends on the number of concurrent traffic flows from that network. An automatic scheduling system manages concurrent traffic to equitably share the bandwidth allocated to a given network. In a concurrent environment, the <qos%> limit may be exceeded when other networks are consuming less than their allocated <qos%> - this mechanism is called borrowing. Borrowing can be enabled or disabled. See the qos command for further information on the borrowing mechanism. Note that the sum of all <qos%> values is not required to equal 100%, although this is the recommended configuration.
The second [2] usage form configures access policies for administrators connecting via ssh or the web administration GUI. Only networks defined with this command are allowed to remotely administer the system via the specified network interface. The administration IP address of the system can be the internal, external or auxiliary IP address, depending on the administration topology defined with the admin topology command usage form. When vlan mode is activated (see the mode command), the internal administration IP address is the IP address associated with the admin 802.1q pseudo device (see the vlan command).
Note that if a user accesses the appliance as an explicit web gateway (proxy), and needs to reach the web administration GUI, the appliance’s internal IP address (or the admin IP address in VLAN mode) must be explicitly allowed as an administration source. However, allowing the appliance itself to access the web administration GUI is not recommended as it may weaken the security of the appliance. Instead, the administrator should configure the web browser not to use the appliance as a web proxy for the appliance’s own internal IP address.
The third [3] usage form configures access policies for monitoring servers using the SNMP protocol. Only SNMP managers defined with this command are allowed to access the appliance via the specified network interface. If no monitoring access policy is defined, SNMP access is not permitted.
Operations such as backing up the system or loading a URL list require access to a file server. Only file servers defined with this command are allowed to exchange data with the appliance. The fourth [4] usage form (with the file keyword) defines access policies for file servers. A file server is identified by its IP address or network name. If no file access policy is defined, file transfers to and from the appliance are not permitted. Supported protocols for file servers are FTP, SFTP and TFTP. For ftp and sftp servers, if a login name is provided, a password is also required. If no password is supplied on the command line, the password will be requested in hidden mode (see also the password command). Note that if the target FTP server supports SSL encryption and the CCC (Clear Command Channel) FTP command, the system will use SSL/TLS during the authentication phase to encrypt the transmitted credentials (login and password).
The integrated antivirus can be used as a service offered to external systems such as an MTA (Mail Transfer Agent). The antivirus server IP address of the system can be the internal, external or auxiliary IP address, depending on the antivirus topology defined with the antivirus topology command usage form. The fifth [5] usage form defines the networks that are allowed to access the appliance as an antivirus service, via a specified network interface. If no antivirus access policy is defined, the antivirus service is not accessible. Traffic bandwidth can also be customised per network using the optional <qos%> parameter. The <qos%> value is a percentage of the ingress or egress bandwidth allocated to antivirus traffic and must be an integer between 1 and 100. The ingress and egress bandwidth values to which this percentage is applied are defined as follows:
• For accesses allowed via the native internal network interface or the 802.1q pseudo network interface called antivirus (in vlan mode), the ingress and egress bandwidths are defined with the command usage form qos shape antivirus internal.
• For accesses allowed via the auxiliary network interface, the ingress and egress bandwidths are defined with the command usage form qos shape antivirus auxiliary.
If no <qos%> value is specified, a default value of 100% is used. If a <qos%> value is specified for the vpnipsec interface, it is ignored, as IPsec VPN traffic flows through encrypted tunnels and therefore cannot be identified for the purpose of applying traffic shaping.
When an appliance is installed as a gateway (as opposed to a manager), it can be directly managed and administered using the CLI and/or the web GUI. When a manager appliance is available, it can be used to configure gateways remotely. Managers use the SSH and SFTP protocols to communicate with gateways: configuration files are uploaded to gateways using SFTP, and commands are executed remotely using SSH (gateways act as SFTP and SSH servers). Note that to allow a manager to access a gateway, SSH administration must be enabled on that gateway (see the admin command for further information).
The sixth [6] usage form grants access to allowed managers to administer and configure the system. Only one master manager and optionally one backup manager may be allowed to administer and configure a gateway. To allow a manager to access the system, use the manager add keywords followed by the manager’s role (master or backup), the logical interface (internal, external or auxiliary) from which the manager is allowed to access the system, the manager’s IP address, and finally the textual representation of the manager’s SSH public key. To retrieve the SSH public key of a manager, use the manager ssh show command on that manager. To remove a manager from the list of allowed managers, use the manager del keywords followed by the manager’s role (master or backup). To erase the entire allowed manager list, use the manager raz keywords. Using the manager keyword without any additional arguments displays the list of all allowed managers. To display the SSH key content of a manager, use the "admin ssh key show <key-id>" command, where <key-id> can be mmanager (for the master manager) or bmanager (for the backup manager).
In cases where previous peers have been defined (see the peer command) and web access is restricted to specified networks (see the first [1] usage form), the seventh [7] usage form defines the networks that are allowed to access the appliance indirectly as a web browsing gateway (i.e. as an explicit web proxy). In this case, the appliance uses the client IP address transmitted in the X-Forwarded-For header (by previous peers) to allow or deny web access.
admin(1), antivirus(1), apply(1), firewall(1), manager(1), mode(1), password(1), peer(1), qos(1), transparent(1), vlan(1)
CacheGuard Technologies <www.cacheguard.com>
Send bug reports or comments to the above author.
Copyright (C) 2009-2026 CacheGuard Technologies - All rights reserved