


File Formats                                             Intro(4)



NAME
     intro - introduction to SunScreen configuration objects

DESCRIPTION
     This      manual      section      (Section       4       in
     /opt/SUNWicg/SunScreen/man)  describes  the types of objects
     that  compose  the  data  used  to  configure  a   SunScreen
     firewall.   Each  object  type has a separate man page.  For
     example, the address object type is  described  in  the  man
     page address(4).

     These objects can be manipulated using the command-line con-
     figuration  editor  (see  ssadm-edit(1M))  or  the SunScreen
     administration GUI.

OBJECT OVERVIEW
     Object      Storage   Access    Description
     Type                  Method
     _________________________________________________________________

     address     common    named     describes an Internet address
                                     or set of addresses.


     screen      common    named     describes Screen objects and
                                     their relationships.


     stateen-    common    named     defines filtering capabilities
     gine        (read-              of packet filter engine.
                 only)


     service     common    named     defines a network service that
                                     can be filtered.


     interface   common    named     describes a network interface
                                     of a Screen.


     certifi-    common    named     refers to an encryption certi-
     cate                            ficate used for SKIP connec-
                                     tions.



     time        common    named     defines a time interval for
                                     time-dependent rules.






                   Last change: 20 April 1999                   1






File Formats                                             Intro(4)



     authuser    external  named     describes a user for adminis-
                                     tration and/or proxy access.


     proxyuser   external  named     describes a user for proxy
                                     access.


     jar_hash    external  named     describes a Java archive hash
                                     (for HTTP proxy applet filter-
                                     ing).



     jar_sig     external  named     describes a Java archive sig-
                                     nature (for HTTP proxy applet
                                     filtering).



     mail_relay  external  named     describes a mail relay (for
                                     SMTP proxy mail filtering).


     mail_spam   external  named     describes a spam domain (for
                                     SMTP proxy mail filtering).


     policy      policy    named     names a security policy (a
                 list                collection of other objects).


     rule        policy    ordered   describes action to be taken
                                     for network traffic of a par-
                                     ticular type.



     nat         policy    ordered   describes a Network Address
                                     Translation.


     accesslo-   policy    ordered   describes who can access the
     cal                             Screen through local adminis-
                                     tration and with what
                                     privileges.









                   Last change: 20 April 1999                   2






File Formats                                             Intro(4)



     accessremote
                 policy
                           ordered
                                     describes who can access the
                                     Screen through remote adminis-
                                     tration and with what
                                     privileges.




     vpngateway  policy    ordered   describes which VPN hosts are
                                     protected behind a particular
                                     certificate and tunnel.






     The data types marked as having "common" storage in the
     table are normally stored in the "common objects registry,"
     which is not part of any particular policy.  These objects
     are used by all policies, so changes to the common objects
     can affect the behavior of multiple policies.  To edit the
     common objects, it is necessary to specify a policy name
     when starting the configuration editor even if you will not
     be modifying any policy objects.


     The data types marked as having "policy" storage in the
     table are stored as part of a policy.  Policy objects often
     refer to common objects and, therefore, can have different
     meaning depending on the value of common objects.  For exam-
     ple, a policy named "Initial" can contain a rule object that
     allows address "A" to communicate with address "B."  The
     address objects "A" and "B" are defined in the common
     objects, while the rule is defined in the policy.

     The data types marked as having "external" storage in the
     above table are almost equivalent to "common" objects, but
     they are stored in a separate database that is not affected
     by the quit, reload, or save commands.  Changes to these
     objects are always immediate, and persist even if the save
     command is not used.  In the next release of the SunScreen
     software, this "external" category will be removed, and
     these object types will change to have "common" storage.

     The data type marked as having "policy list" storage in the
     above table represents the names of the policies themselves.
     Minimal capabilities are provided by the configuration edi-
     tor to manage the policy list.  A policy currently being



                   Last change: 20 April 1999                   3






File Formats                                             Intro(4)



     edited (or portions of it) can be saved or "cloned" into a
     new policy.  Other policy requests, such as add, delete, and
     rename, are provided by the ssadm policy command.

SEE ALSO
     ssadm-edit(1M), ssadm-policy(1M), accesslocal(4),
     accessremote(4), address(4), authuser(4), certificate(4),
     common(4), interface(4), jar_hash(4), jar_sig(4),
     mail_relay(4), mail_spam(4), nat(4), policy(4), prox-
     yuser(4), rule(4), screen(4), service(4), stateengine(4),
     time(4), vpngateway(4)

     SunScreen EFS 3.0 Administration Guide










































                   Last change: 20 April 1999                   4



