NETGEAR ProSAFE SRX5308 User manual

350 East Plumeria Drive
San Jose, CA 95134
USA
August 2012
202-11138-01
v1.0
ProSafe Gigabit Quad WAN
SSL VPN Firewall SRX5308
CLI Reference Manual

2
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
© 2012 NETGEAR, Inc. All rights reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated
into any language in any form or by any means without the written permission of NETGEAR, Inc.
NETGEAR, the NETGEAR logo, and Connect with Innovation are trademarks and/or registered trademarks of
NETGEAR, Inc. and/or its subsidiaries in the United States and/or other countries. Information is subject to change
without notice. Other brand and product names are registered trademarks or trademarks of their respective
holders. © 2012 All rights reserved.
Technical Support
Thank you for choosing NETGEAR. To register your product, get the latest product updates, get support online, or
for more information about the topics covered in this manual, visit the Support website at
http://support.netgear.com.
Phone (US & Canada only): 1-888-NETGEAR
Phone (Other Countries): Check the list of phone numbers at
http://support.netgear.com/app/answers/detail/a_id/984.
Statement of Conditions
To improve internal design, operational function, and/or reliability, NETGEAR reserves the right to make changes
to the products described in this document without notice. NETGEAR does not assume any liability that may occur
due to the use, or application of, the product(s) or circuit layout(s) described herein.
Revision History
Publication Part Number Version Publish Date Comments
202-11138-01 1.0 August 2012 First publication

3
Contents
Chapter 1 Introduction
Command Syntax and Conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
Command Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
Description of a Command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
Common Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
The Four Categories of Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
The Four Main Modes for Configuration Commands . . . . . . . . . . . . . . . . .10
Save Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Global Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
The Three Basic Types of Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Command Autocompletion and Command Abbreviation . . . . . . . . . . . . . .15
CLI Line-Editing Conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Access the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Chapter 2 Overview of the Configuration Commands
Network Settings (Net Mode) Configuration Commands . . . . . . . . . . . . . .17
Security Settings (Security Mode) Configuration Commands . . . . . . . . . .20
Administrative and Monitoring Settings (System Mode)
Configuration Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
VPN Settings (VPN Mode) Configuration Commands . . . . . . . . . . . . . . . .24
Chapter 3 Net Mode Configuration Commands
General WAN Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
IPv4 WAN Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
IPv6 WAN Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46
IPv6 Tunnel Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
Dynamic DNS Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
IPv4 LAN Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .54
IPv6 LAN Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .66
IPv4 DMZ Setup Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
IPv6 DMZ Setup Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .76
WAN QoS Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
IPv4 Routing Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93
IPv6 Routing Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98
Chapter 4 Security Mode Configuration Commands
Security Services Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101
Security Schedules Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110

4
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
IPv4 Add Firewall Rule and Edit Firewall Rule Commands . . . . . . . . . . .112
IPv4 General Firewall Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154
IPv6 Firewall Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .155
Attack Check Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162
Session Limit, Time-Out, and Advanced Commands. . . . . . . . . . . . . . . .165
Address Filter and IP/MAC Binding Commands . . . . . . . . . . . . . . . . . . .168
Port Triggering Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .173
UPnP Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .176
Bandwidth Profile Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177
Content Filtering Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .180
Chapter 5 System Mode Configuration Commands
Remote Management Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .186
SNMP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Time Zone Command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
WAN Traffic Meter Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
Firewall Logs and Email Alerts Commands . . . . . . . . . . . . . . . . . . . . . . .201
Chapter 6 VPN Mode Configuration Commands
IPSec VPN Wizard Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .208
IPSec IKE Policy Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .210
IPSec VPN Policy Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .216
IPSec VPN Mode Config Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . .228
SSL VPN Portal Layout Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . .231
SSL VPN Authentication Domain Commands . . . . . . . . . . . . . . . . . . . . .234
SSL VPN Authentication Group Commands . . . . . . . . . . . . . . . . . . . . . .238
SSL VPN User Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .239
SSL VPN Port Forwarding Commands . . . . . . . . . . . . . . . . . . . . . . . . . .246
SSL VPN Client and Client Route Commands. . . . . . . . . . . . . . . . . . . . .248
SSL VPN Resource Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .252
SSL VPN Policy Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .256
RADIUS Server Command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .263
PPTP Server Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .265
L2TP Server Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .266
Chapter 7 Overview of the Show Commands
Network Settings (Net Mode) Show Commands . . . . . . . . . . . . . . . . . . .267
Security Settings (Security Mode) Show Commands. . . . . . . . . . . . . . . .269
Administrative and Monitoring Settings (System Mode)
Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .270
VPN Settings (VPN Mode) Show Commands . . . . . . . . . . . . . . . . . . . . .271
Chapter 8 Show Commands
Network Settings (Net Mode) Show Commands . . . . . . . . . . . . . . . . . . .273
WAN IPv4 and WAN IPv6 Show Commands. . . . . . . . . . . . . . . . . . . .273

5
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Network Settings (Net Mode) Show Commands . . . . . . . . . . . . . . . . . . .273
WAN IPv4 and WAN IPv6 Show Commands. . . . . . . . . . . . . . . . . . . .273
IPv6 Mode, IPv6 Tunnel, and SIIT Show Commands . . . . . . . . . . . . .277
LAN DHCP Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .278
Dynamic DNS Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .279
IPv4 LAN Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .280
IPv6 LAN Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .284
DMZ Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .286
Routing Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .288
Network Statistics Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . .289
Security Settings (Security Mode) Show Commands. . . . . . . . . . . . . . . .290
Services Show Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290
Schedules Show Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292
Firewall Rules Show Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292
Attack Checks Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
Session Limits Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . .295
Advanced Firewall Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . .296
Address Filter Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .296
Port Triggering Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . .297
UPnP Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .298
Bandwidth Profiles Show Command . . . . . . . . . . . . . . . . . . . . . . . . . .298
Content Filtering Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . .299
Administrative and Monitoring Settings (System Mode)
Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .300
Remote Management Show Command . . . . . . . . . . . . . . . . . . . . . . . .301
SNMP Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .301
Time Show Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .302
Firmware Version Show Command . . . . . . . . . . . . . . . . . . . . . . . . . . .302
Status Show Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .303
WAN Traffic Meter Show Command. . . . . . . . . . . . . . . . . . . . . . . . . . .306
Logging Configuration Show Commands. . . . . . . . . . . . . . . . . . . . . . .307
Logs Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .309
VPN Settings (VPN Mode) Show Commands . . . . . . . . . . . . . . . . . . . . .311
IPSec VPN Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .311
SSL VPN Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .313
SSL VPN User Show Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . .316
RADIUS Server Show Command. . . . . . . . . . . . . . . . . . . . . . . . . . . . .319
PPTP Server Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .320
L2TP Server Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .320
Chapter 9 Utility Commands
Overview Util Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .321
Firmware Backup, Restore, and Upgrade Commands. . . . . . . . . . . . . . .322
Diagnostic Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .323
CLI Command Index

6
1
1. Introduction
This document describes the command-line interface (CLI) for the NETGEAR ProSafe Gigabit
Quad WAN SSL VPN Firewall SRX5308.
This chapter introduces the CLI interface. It includes the following sections:
• Command Syntax and Conventions
• The Four Categories of Commands
• The Four Main Modes for Configuration Commands
• Global Commands
• The Three Basic Types of Commands
• Command Autocompletion and Command Abbreviation
• Access the CLI
Note: For more information about the topics covered in this manual, visit
the support website at http://support.netgear.com.
Note: For more information about the features that you can configure
using the CLI, see the ProSafe Gigabit Quad WAN SSL VPN
Firewall SRX5308 Reference Manual.
Note: You cannot generate and upload a certificate through the CLI. You
need to access the web management interface to manage these
tasks.

Introduction
7
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Command Syntax and Conventions
A command is one or more words that can be followed by one or more keywords and
parameters. Keywords and parameters can be required or optional:
• A keyword is a predefined string (word) that narrows down the scope of a command. A
keyword can be followed by an associated parameter or by associated keywords. In
many cases, these associated keywords are mutually exclusive, so you need to select
one of them. In some cases, this manual refers to a group of words as a keyword.
• A parameter is a variable for which you need to type a value. You need to replace the
parameter name with the appropriate value, which might be a name or number. A
parameter can be associated with a command or with a keyword.
This manual lists each command by its full command name and provides a brief description
of the command. In addition, for each command, the following information is provided:
• Format.Shows the command keywords and the required and optional parameters.
• Mode. Identifies the command mode you need to be in to access the command. (With
some minor exceptions, the mode is always described using lower-case letters.)
• Related show command or commands. Identifies and links to the show command or
commands that can display the configured information.
For more complicated commands, in addition to the format, mode, and related show
command or commands, the following information is provided:
• Table. Explains the keywords and parameters that you can use for the command.
• Example. Shows a CLI example for the command.
Command Conventions
In this manual, the following type font conventions are used:
• A command name is stated in bold font.
• A keyword name is stated in bold font.
• A parameter name is stated in italic font.
The keywords and parameters for a command might include mandatory values, optional
values, or choices. The following table describes the conventions that this manual uses to
distinguish between value types:
Table 1. Command conventions
Symbol Example Description
< > angle brackets <value>Indicate that you need to enter a value in place of the
brackets and text inside them. (value is the parameter.)
[ ] square brackets [value]Indicate an optional parameter that you can enter in place of
the brackets and text inside them. (value is the parameter.)

Introduction
8
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Description of a Command
The following example describes the net radvd pool lan edit <row id>command:
net radvd pool lan edit is the command name.
<row id>is the required parameter for which you need to enter a value after you type
the command words.
The command lets you enter the net-config [radvd-pool-lan] mode, from which you can
issue the following keywords and parameters:
prefix_type {6To4 {sla_id <id number>} | {Global-Local-ISATAP}
{prefix_address <ipv6-address>} {prefix_length
<prefix length>}}
prefix_life_time <seconds>
Explanation of the keywords and parameters:
prefix_type is a keyword. The required associated keyword that you need to
select is either 6To4 or Global-Local-ISATAP.
• If you select 6To4, you also need to issue the sla_id keyword and enter a
value for the <id number>parameter.
• If you select Global-Local-ISATAP, you also need to issue the
prefix_address keyword and enter a value for the <ipv6-address>
parameter, and you need to issue the prefix_length keyword and enter a
value for the <prefix length>parameter.
prefix_life_time is a keyword. <seconds>is the required parameter for which
you need to enter a value.
Command example:
SRX5308> net radvd pool lan edit 12
net-config[radvd-pool-lan]> prefix_type Global-Local-ISATAP
net-config[radvd-pool-lan]> prefix_address 10FA:2203:6145:4201::
net-config[radvd-pool-lan]> prefix_length 10
net-config[radvd-pool-lan]> prefix_life_time 3600
net-config[radvd-pool-lan]> save
{ } curly braces {choice1 | choice2}Indicate that you need to select a keyword from the list of
choices. (choice1 and choice1 are keywords.)
| vertical bars choice1 | choice2 Separate the mutually exclusive choices. (choice1 and
choice1 are keywords.)
[ { } ] braces within
square brackets [{choice1 | choice2}] Indicate a choice within an optional element. (choice1 and choice1 are keywords.)
Table 1. Command conventions (continued)
Symbol Example Description

Introduction
9
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Common Parameters
Parameter values might be names (strings) or numbers. To use spaces as part of a name
parameter, enclose the name value in double quotes. For example, the expression “System
Name with Spaces” forces the system to accept the spaces. Empty strings (“”) are not valid
user-defined strings. The following table describes common parameter values and value
formatting:
The Four Categories of Commands
There are four CLI command categories:
• Configuration commands with four main configuration modes. For more information, see
the following section, The Four Main Modes for Configuration Commands). Save
commands also fall into this category (see Save Commands on page 12).
• Show commands that are available for the four main configuration modes (see Chapter 7,
Overview of the Show Commands and Chapter 8, Show Commands).
• Utility commands (see Chapter 9, Utility Commands).
• Global commands (see Global Commands on page 13).
Table 2. Common parameters
Parameter Description
ipaddr This parameter is a valid IPv4 address. You need to enter the IP address in the a.b.c.d
format, in which each octet is a number in the range from 0 to 255 (both inclusive), for
example, 10.12.140.218.
The CLI accepts decimal, hexadecimal, and octal formats through the following input
formats (where n is any valid decimal, hexadecimal, or octal number):
• 0xn(CLI assumes hexadecimal format)
• 0n(CLI assumes octal format with leading zeros)
• n(CLI assumes decimal format)
ipv6-address This parameter is a valid IPv6 address. You can enter the IPv6 address in the following
formats:
• FE80:0000:0000:0000:020F:24FF:FEBF:DBCB, or
• FE80:0:0:0:20F:24FF:FEBF:DBCB, or
• FE80::20F:24FF:FEBF:DBCB, or
• FE80:0:0:0:20F:24FF:128:141:49:32
For additional information, see RFC 3513.
Character strings Use double quotation marks to identify character strings, for example, “System Name with
Spaces”. An empty string (“”) is not valid.

Introduction
10
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
The Four Main Modes for Configuration Commands
For the configuration commands, there are four main modes in the CLI: net, security, system,
and vpn. Chapter 2, Overview of the Configuration Commands lists all commands in these
modes, and each of these modes is described in detail in a separate chapter (see Chapter 3
through Chapter 6).
The following table lists the main configuration modes, the configuration modes, the features
that you can configure in each configuration mode, and, for orientation, the basic web
management interface (GUI) path to the feature.
Table 3. Main configuration modes
__________________________CLI________________________ ___Web Management Interface (GUI)___
Main Mode Submode Feature That You Can Configure Basic Path
Network configuration commands
net ddns Dynamic DNS Network Configuration > Dynamic DNS
dmz DMZ for IPv4
DMZ for IPv6 Network Configuration > DMZ Setup
ethernet VLAN assignment to LAN interface Network Configuration > LAN Setup
ipv6 IPv4 or IPv4/IPv6 mode Network Configuration > WAN Settings
ipv6_tunnel IPv6 tunnels Network Configuration > WAN Settings
lan IPv4 LAN settings and VLANs
LAN groups for IPv4
Secondary IPv4 LAN addresses
Advanced IPv4 LAN settings
Fixed and reserved DHCP IPv4
addresses
LAN IPv4 traffic meter profiles
IPv6 LAN settings
Secondary IPv6 LAN addresses
IPv6 LAN DHCP address pools
IPv6 prefix delegation for the LAN
Network Configuration > LAN Setup
protocol_binding Protocol bindings Network Configuration > Protocol Binding
qos WAN QoS profiles Network Configuration > QoS
radvd IPv6 RADVD and pools for the
LAN
IPv6 RADVD and pools for the
DMZ
Network Configuration > LAN Setup
Network Configuration > DMZ Setup
routing Dynamic IPv4 routes
Static IPv4 routes
Static IPv6 routes
Network Configuration > Routing

Introduction
11
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
net
(continued) siit Stateless IP/ICMP Translation Network Configuration > SIIT
wan IPv4 WAN (Internet) settings
Secondary IPv4 WAN addresses
IPv6 WAN (Internet) settings
MTU, port speed, and MAC
address, failure detection method,
and upload/download settings
Network Configuration > WAN Settings
wan_settings NAT or Classical Routing
Load balancing settings for IPv4 Network Configuration > WAN Settings
Security configuration commands
security address_filter Source MAC filters
IP/MAC bindings for IPv4
IP MAC bindings for IPv6
Security > Address Filter
bandwidth Bandwidth profiles Security > Bandwidth Profile
content_filter Group filtering
Blocked keywords
Web components
Trusted domains
Security > Content Filtering
firewall All IPv4 firewall rules
All IPv6 firewall rules
Attack checks
Session limits and time-outs
SIP ALG
Security > Firewall
porttriggering_rules Security > Port Triggering
schedules Security > Schedule
services Custom services
LAN and WAN IP groups
LAN QoS profiles
Security > Services
upnp Security > UPnP
Administration and monitoring configuration commands
system logging Monitoring > Firewall Logs & E-mail
remote_management Administration > Remote Management
snmp Administration > SNMP
Table 3. Main configuration modes (continued)
__________________________CLI________________________ ___Web Management Interface (GUI)___
Main Mode Submode Feature That You Can Configure Basic Path

Introduction
12
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Save Commands
The following table describes the configuration commands that let you save or cancel
configuration changes in the CLI. You can use these commands in any of the four main
configuration modes. These commands are not preceded by a period.
system
(continued) time Administration > Time Zone
traffic_meter WAN traffic meters Monitoring > Traffic Meter
VPN configuration commands
vpn ipsec IKE policies
VPN policies
VPN IPSec Wizard
Mode Config records
RADIUS servers
VPN > IPSec VPN
l2tp L2TP server VPN > L2TP Server
pptp PPTP server VPN > PPTP Server
sslvpn SSL policies
Resources and resource objects
Portal layouts
SSL VPN clients
Client routes
Port forwarding
VPN > SSL VPN
Domains
Groups
User accounts
User login and IP policies
Users
Table 4. Save commands
Command Description
save Save the configuration changes.
exit Save the configuration changes and exit the current configuration mode.
cancel Roll back the configuration changes.
Table 3. Main configuration modes (continued)
__________________________CLI________________________ ___Web Management Interface (GUI)___
Main Mode Submode Feature That You Can Configure Basic Path

Introduction
13
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Commands That Require Saving
After you have issued a command that includes the word configure, add, or edit, you
enter a configuration mode from which you can issue keywords and associated parameters.
These are examples of commands for which you need to save your changes:
• net lan ipv4 configure <vlan id>lets you enter the net-config [lan-ipv4]
configuration mode. After you made your changes, issue save or exit to save your
changes.
• security content_filter trusted_domain add lets you enter the
security-config [approved-urls] configuration mode. After you made your changes, issue
save or exit to save your changes.
• vpn sslvpn users groups add lets you enter the vpn-config [user-groups]
configuration mode. After you made your changes, issue save or exit to save your
changes.
Commands That Do Not Require Saving
You do not need to save your changes after you have issued a command that deletes,
disables, or enables a row ID, name, IP address, or MAC address, or that lets you make a
configuration change without entering another configuration mode.
These are examples of commands that you do not need to save:
• net lan dhcp reserved_ip delete <mac address>
• vpn ipsec vpnpolicy disable <vpn policy name>
• security firewall ipv4 enable <row id>
• security firewall ipv4 default_outbound_policy {Allow | Block}
Global Commands
The following table describes the global commands that you can use anywhere in the CLI.
These commands need to be preceded by a period.
Table 5. Global CLI commands
Command Description
.exit Exit the current session.
.help Display an overview of the CLI syntax.
.top Return to the default command mode or root.
.reboot Reboot the system.
.history Display the command-line history of the current session.

Introduction
14
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
The Three Basic Types of Commands
You can encounter the following three basic types of commands in the CLI:
• Entry commands to enter a configuration mode. Commands that let you enter a
configuration mode from which you can configure various keywords and associated
parameters and keywords. For example, the net wan wan1 ipv4 configure
command lets you enter the net-config [wan1-ipv4] mode, from which you can configure
the IPv4 WAN settings.
This type of command is the most common in the CLI and is always indicated by two
steps in this manual, each one showing the format and mode:
Sometimes, you need to enter a parameter to enter a configuration mode. For example,
security schedules edit <row id>requires you to enter the row ID parameter to
enter the security-config [schedules] mode, from which you can modify various keywords
and associated parameters and keywords.
• Commands with a single parameter. Commands that require you to supply one or more
parameters and that do not let you enter another configuration mode. The parameter is
usually a row ID or a name. For example, security firewall ipv4 delete
<row id>requires you to enter the row ID parameter to delete the firewall rule.
For this type of command, the format and mode are shown in this manual:
• Commands without parameters. Commands that do not require you to supply a
parameter after the command and that do not let you enter another configuration mode.
For example, util restore_factory_defaults does not require parameters.
For this type of command also, the format and mode are shown in this manual:
Step 1 Format net wan wan ipv4 configure <wan interface>
Mode net
Step 2 Format This section shows the keywords and associated parameters, for example:
isp_connection_type {STATIC | DHCPC | PPPoE | PPTP}
Mode net-config [wan1-ipv4]
Format security firewall ipv4 delete <row id>
Mode security
Format util restore_factory_defaults
Mode util

Introduction
15
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Command Autocompletion and Command Abbreviation
Command autocompletion finishes spelling the command when you type enough letters of a
command to uniquely identify the command keyword. You need to type all of the required
keywords and parameters before you can use autocompletion.
The following keys both perform autocompletion for the current command. If the command
prefix is not unique, a subsequent repeat of the key displays possible completions.
• Enter or Return key. Autocompletes, syntax-checks, and then executes the command. If
there is a syntax error, the offending part of the command is highlighted and explained.
• Spacebar. Autocompletes, or if the command is already resolved, inserts a space.
CLI Line-Editing Conventions
The following table describes the key combinations that you can use to edit commands or
increase the speed of command entry. Access this list from the CLI by issuing .help.
Table 6. CLI editing conventions
Key or Key Sequence Description
Invoking context-sensitive help
? Displays context-sensitive help. The information that displays consists either of a list of
possible command completions with summaries or of the full syntax of the current
command. When a command has been resolved, a subsequent repeat of the help key
displays a detailed reference.
Autocompleting
Note: Command autocompletion finishes spelling the command when you type enough letters of a command
to uniquely identify the command keyword. However, you need to type all of the required keywords and
parameters before you use autocompletion.
Enter (or Return) Autocompletes, syntax-checks, and then executes a command. If there is a syntax
error, the offending part of the command line is highlighted and explained. If the
command prefix is not unique, a subsequent repeat of the key displays possible
completions.
Spacebar Autocompletes, or if the command is already resolved, inserts a space. If the command
prefix is not unique, a subsequent repeat of the key displays possible completions.
Moving around
Ctrl-A Go to the beginning of the line.
Ctrl-E Go to the end of the line.
Up arrow Go to the previous line in the history buffer.
Down arrow Go to the next line in the history buffer.
Left arrow Go backward one character.

Introduction
16
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Access the CLI
You can access the CLI by logging in with the same user credentials (user name and
password) that you use to access the web management interface. SRX5308> is the CLI
prompt.
SRX5308 login: admin
Password:
************************************************
Welcome to SRX5308 Command Line Interface
************************************************
SRX5308>
Right arrow Go forward one character.
Deleting
Ctrl-C Delete the entire line.
Ctrl-D Delete the next character.
Ctrl-K Delete all characters to the end of the line from where the cursor is located.
Backspace Delete the previous character.
Invoking escape sequences
!! Substitute the previous line.
!N Substitute the Nth line, in which N is the absolute line number as displayed in the
output of the history command.
!-N Substitute the line that is located N lines before the current line, in which N is a relative
number in relation to the current lint.
Table 6. CLI editing conventions (continued)
Key or Key Sequence Description

17
2
2. Overview of the Configuration
Commands
This chapter provides an overview of all configuration commands in the four configuration
command modes. The keywords and associated parameters that are available for these
commands are explained in the following chapters. The chapter includes the following sections:
• Network Settings (Net Mode) Configuration Commands
• Security Settings (Security Mode) Configuration Commands
• Administrative and Monitoring Settings (System Mode) Configuration Commands
• VPN Settings (VPN Mode) Configuration Commands
Network Settings (Net Mode) Configuration Commands
Enter the net ? command at the CLI prompt to display the submodes in the net mode. The
following table lists the submodes and their commands in alphabetical order:
Table 7. Net mode configuration commands
Submode Command Name Purpose
ddns net ddns configure Enable, configure, or disable DDNS service.
dmz
net dmz ipv4 configure Enable, configure, or disable the IPv4 DMZ.
net dmz ipv6 configure Enable, configure, or disable the IPv6 DMZ.
net dmz ipv6 pool configure <ipv6 address> Configure a new or existing IPv6 DMZ DHCP
address pool.
net dmz pool ipv6 delete < ipv6 address> Delete an IPv6 DMZ DHCP address pool.
ethernet net ethernet configure <interface name or
number> Configure a VLAN for a LAN interface.
ipv6 net ipv6 ipmode configure Configure the IP mode (IPv4 only or
IPv4/IPv6).
ipv6_tunnel net ipv6_tunnel isatap add Configure a new IPv6 ISATAP tunnel.
net ipv6_tunnel isatap delete <row id> Delete an IPv6 ISATAP tunnel.

Overview of the Configuration Commands
18
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
ipv6_tunnel
(continued) net ipv6_tunnel isatap edit <row id> Configure an existing IPv6 ISATAP tunnel.
net ipv6_tunnel six_to_four configure Enable or disable automatic (6to4) tunneling.
lan
net lan dhcp reserved_ip configure
<mac address> Bind a MAC address to an IP address for DHCP reservation or change an existing
binding, and assign a LAN group.
net lan dhcp reserved_ip delete
<mac address> Delete the binding of a MAC address to an IP address.
net lan ipv4 advanced configure Configure advanced LAN settings such as the
MAC address for VLANs and ARP broadcast.
net lan ipv4 configure <vlan id> Configure a new or existing VLAN.
net lan ipv4 default_vlan Configure the default VLAN for each port.
net lan ipv4 delete <vlan id> Delete a VLAN.
net lan ipv4 disable <vlan id> Disable a VLAN.
net lan ipv4 enable <vlan id> Enable a VLAN.
net lan ipv4 multi_homing add Configure a new secondary IPv4 address.
net lan ipv4 multi_homing delete <row id> Delete a secondary IPv4 address.
net lan ipv4 multi_homing edit <row id> Configure an existing secondary IPv4
address.
net lan ipv4 traffic_meter configure
<ip address> Configure a traffic meter profile for an IPv4 address.
net lan ipv4 traffic_meter delete <row id> Delete a traffic meter profile.
net lan ipv6 configure Configure the IPv6 LAN address settings and
DHCPv6.
net lan ipv6 multi_homing add Configure a new secondary IPv6 address.
net lan ipv6 multi_homing delete <row id> Delete a secondary IPv6 address.
net lan ipv6 multi_homing edit <row id> Configure an existing secondary IPv6
address.
net lan ipv6 pool add Configure a new IPv6 LAN DHCP address
pool.
net lan ipv6 pool delete <row id> Delete an IPv6 LAN DHCP address pool.
net lan ipv6 pool edit <row id> Configure an existing IPv6 LAN DHCP
address pool.
net lan ipv6 prefix_delegation add Configure a new prefix for IPv6 LAN prefix
delegation.
Table 7. Net mode configuration commands (continued)
Submode Command Name Purpose

Overview of the Configuration Commands
19
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
lan
(continued)
net lan ipv6 prefix_delegation delete <row id> Delete a prefix for IPv6 LAN prefix delegation.
net lan ipv6 prefix_delegation edit <row id> Configure an existing prefix for IPv6 LAN
prefix delegation.
net lan lan_groups edit <row id>
<new group name> Change an existing LAN default group name.
protocol binding
net protocol_binding add Configure a new protocol binding.
net protocol_binding delete Delete a protocol binding.
net protocol_binding disable Disable a protocol binding.
net protocol_binding edit <row id> Configure an existing protocol binding.
net protocol_binding enable Enable a protocol binding.
qos
net qos configure Configure the QoS mode for the WAN
interfaces.
net qos profile add Configure a new WAN QoS profile.
net qos profile delete <row id> Delete a WAN QoS profile.
net qos profile disable <row id> Disable a WAN QoS profile.
net qos profile edit <row id> Configure an existing WAN QoS profile.
net qos profile enable <row id> Enable a WAN QoS profile.
radvd net radvd configure dmz Configure the IPv6 RADVD for the DMZ.
net radvd configure lan Configure the IPv6 RADVD for the LAN.
routing
net routing dynamic configure Configure RIP and the associated MD5 key
information.
net routing static ipv4 configure <route name> Configure a new or existing IPv4 static route.
net routing static ipv4 delete <route name> Delete an IPv4 static route.
net routing static ipv4 delete_all Delete all IPv4 routes.
net routing static ipv6 configure <route name> Configure a new or existing IPv6 static route.
net routing static ipv6 delete <route name> Delete an IPv6 static route.
net routing static ipv6 delete_all Delete all IPv6 routes.
siit net siit configure Configure Stateless IP/ICMP Translation
Table 7. Net mode configuration commands (continued)
Submode Command Name Purpose

Overview of the Configuration Commands
20
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Security Settings (Security Mode) Configuration
Commands
Enter the security ? command at the CLI prompt to display the submodes in the security
mode. The following table lists the submodes and their commands in alphabetical order:
wan
net wan port_setup configure <wan interface> Configure the MTU, port speed, and MAC
address of the VPN firewall.
net wan wan ipv4 configure <wan interface> Configure the IPv4 settings of the WAN
interface.
net wan wan ipv4 secondary_address add
<wan interface> Configure a secondary IPv4 WAN address.
net wan wan ipv4 secondary_address delete
<row id> Delete a secondary IPv4 WAN address.
net wan wan ipv6 configure <wan interface> Configure the IPv6 settings of the WAN
interface.
wan_settings
net wan_settings load_balancing configure Configure the load balancing settings for two
WAN interfaces that are configured for IPv4.
net wan_settings wanmode configure Configure the mode of IPv4 routing (NAT or
classical routing) between the WAN interface
and LAN interfaces.
Table 8. Security mode configuration commands
Submode Command Name Purpose
address_filter
security address_filter ip_or_mac_binding add Configure a new IP/MAC binding rule.
security address_filter ip_or_mac_binding
delete <row id> Delete an IP/MAC binding rule.
security address_filter ip_or_mac_binding edit
<row id> Configure an existing IP/MAC binding rule.
security address_filter ip_or_mac_binding
enable_email_log <ip version> Configure the email log for IP/MAC Binding violations.
security address_filter mac_filter configure Configure the source MAC address filter.
security address_filter mac_filter source add Configure a new MAC source address.
security address_filter mac_filter source delete
<row id> Delete a MAC source address.
Table 7. Net mode configuration commands (continued)
Submode Command Name Purpose