Interface object has several attributes that define its function, such
as "Management interface", "external" etc.
- Name: the name of the interface object in Firewall Builder must
match exactly the name of the interface of the firewall machine it
represents. This will be something like "eth0", "eth1", "en0", "br0"
and so on.
- Label: On most OS this field is not used and serves the purpose of
a descriptive label. Firewall Builder GUI uses a label, if it is not
blank, to show interfaces in the tree. One of the suggested uses for
this field is to mark interfaces to reflect the network topology
(’outside’, ’inside’) or the purpose (’web frontend’ or ’backup
subnet’). The label is mandatory for Cisco PIX though, where it must
reflect the network topology.
- "Management interface": Sometimes the host has several network
interfaces in which case one of them can be marked as the ’manaagement
interface’. The management interface is used for all communication
between Firewall Builder and the host.
- "External interface (insecure)": marks an interface that connects
to the Internet.
- "Unprotected interface": marks interface to which fwbuilder should
not assign any access lists (used only with Cisco IOS platform)
- "Regular Interface": Use this option if the interface has an IP
address assigned to it manually.
- "Address is assigned dynamically": Use this option if the
interface has a dynamic address (obtained by means of DHCP or PPP or
another protocol); in this case an address is unknown at the moment
when Firewall Builder generates the firewall policy.
- "Unnumbered interface": Use this option if the interface can never
have an IP address, such as the ethernet interface used to run PPPoE
communication on some ADSL connections, tunnel endpoint interface, or
an interface on a bridging firewall. See below Section 5.3.1 for more
detailed discussion of these different types of interfaces.
- "Bridge port": this option is used for port of bridged firewall.
- "Security level": security level of this interface, used only with
Cisco PIX (ASA)
- "Network zone": network zone of this interface, used only with
Cisco PIX (ASA). Network zone drop-down list shows all network obejcts
and groups of addresses and networks present in the tree. Choose one
of them to tell the compiler which networks and blocks of addresses
can be reached through this interface. Compiler uses this information
to decide which interface each ACL rule should be associated with
based on the addresses used in the destination of the rule.
