


File Formats                                            screen(4)



NAME
     screen - screen object for SunScreen configuration

DESCRIPTION
     A screen object  maintains  information  about  the  various
     Screens  in the network as well as the relationships between
     them.  It is manipulated via  the  configuration  editor  or
     SunScreen administration GUI.

     There are two types of Screens:  primary and secondary.   If
     a  collection  of  Screens is being managed as a Centralized
     Management Group, then one of the Screens in the  collection
     is  the  primary  and  the other Screens are secondary.  The
     primary Screen is the Screen which should be  used  for  all
     administrative  purposes  as  it holds all the configuration
     data and is responsible for communicating with the  rest  of
     the Screens to keep their data updated.  A standalone Screen
     (one that is not part of a Centralized Management Group)  is
     considered primary and has no affiliated secondary Screens.

     The screen object for a secondary Screen  must  indicate  in
     its MASTER field the name of the primary Screen.  The screen
     object for a primary Screen has no MASTER  value  specified.
     It  will  be  recognized as a Centralized Management Group's
     primary screen if its name is in  the  MASTER  field  of  at
     least one other screen object.


     A Screen may also have various  flags  set  or  not.   These
     include  whether or not the Screen may participate in a SKIP
     Certificate Discovery Protocol, if it is willing to  receive
     routing  information as well as which naming service to use.
     These are controlled by the following keywords:  CDP,  ROUT-
     ING,  DNS,  and  NIS.   If present, the indicated feature is
     enabled.  If not present, then it is not enabled.

     If the Screen will be emitting SNMP  packets,  the  list  of
     receivers,  by  IP  address, is specified following the SNMP
     keyword.  These hosts will be sent SNMP  packets.   You  can
     specify up to five hosts to be receivers.

     If the Screen will be using the SNMP Timed Status  Indicator
     feature,  the  SNMP_TIMER  must  be  set  by  following  the
     SNMP_TIMER keyword with a time value, in minutes.  You  must
     have  SNMP  receivers  defined in order to use this feature.
     If it is not set, then it is not enabled.

     To control the size of the log, the LOGSIZE keyword is used.
     It  is  specified  in  Mega-Bytes and defaults to 100 if not
     specified.





                  Last change: 4 February 2000                  1






File Formats                                            screen(4)



     If the Screen will be installed stealth  mode,  the  network
     that  it partitions must be specified.  This is done via the
     STEALTH_NET #.#.#.# #.#.#.# keyword, where the first #.#.#.#
     is  the  network  address and the second #.#.#.# is the net-
     mask. This data is used to  identify  broadcast  packets  so
     they can be filtered and processed properly.

     If the Screen will participate in a  centralized  management
     group or will be administered remotely, the following fields
     must be specified:  ADMIN_IP, ADMIN_CERTIFICATE, KEY,  DATA,
     MAC, COMPRESSION and TUNNEL.

     The ADMIN_IP is an IP address that can be used  to  communi-
     cate  with  the  Screen  for  administrative traffic.  It is
     specified as an IP address: #.#.#.#.

     The ADMIN_CERTIFICATE is the name of a certificate that  can
     be used to secure administrative traffic to the Screen.

     KEY, DATA, MAC and COMPRESSION are algorithms of  the  given
     type to control how data is encrypted between the SunScreens
     in the administrative group.

     The TUNNEL field is optional and should be specified if tun-
     nelling is to be used.  It is the name of an Address object.

     If the Screen will participate in an HA cluster, then either
     HA_PRIMARY  or  HA_SECONDARY  must be set.  If HA_PRIMARY is
     set, then so must HA_ADMIN_IP #.#.#.# and HA_ETHER  #:#:#:#.
     If  HA_SECONDARY  is  set,  then  it  should  not  define an
     ADMIN_CERTIFICATE.  This value will  be  inferred  from  the
     HA_PRIMARY.

     All Screens may have an optional  COMMENT  field  associated
     with  them  which  is  a 256-character or less user-provided
     comment.

     The Screen object named "*" is reserved and cannot be  modi-
     fied  in  any  way.  It  is  used  to indicate "any" Screen,
     including no  Screen,  when  listing  or  searching  through
     object types that may refer to a Screen object.

SEE ALSO
     ssadm-edit(1M), address(4), certificate(4)











                  Last change: 4 February 2000                  2



