config web-proxy explicit
Description: Configure explicit Web proxy settings.
set status [enable|disable]
set ftp-over-http [enable|disable]
set socks [enable|disable]
set http-incoming-port {user}
set https-incoming-port {user}
set ftp-incoming-port {user}
set socks-incoming-port {user}
set incoming-ip {ipv4-address-any}
set outgoing-ip {ipv4-address-any}
set ipv6-status [enable|disable]
set incoming-ip6 {ipv6-address}
set outgoing-ip6 {ipv6-address}
set strict-guest [enable|disable]
set pref-dns-result [ipv4|ipv6]
set unknown-http-version [reject|best-effort]
set realm {string}
set sec-default-action [accept|deny]
set https-replacement-message [enable|disable]
set message-upon-server-error [enable|disable]
set pac-file-server-status [enable|disable]
set pac-file-url {user}
set pac-file-server-port {user}
set pac-file-name {string}
set pac-file-data {user}
config pac-policy
Description: PAC policies.
edit <policyid>
set status [enable|disable]
set srcaddr <name1>, <name2>, ...
set srcaddr6 <name1>, <name2>, ...
set dstaddr <name1>, <name2>, ...
set pac-file-name {string}
set pac-file-data {user}
set comments {var-string}
next
end
set ssl-algorithm [high|medium|...]
set trace-auth-no-rsp [enable|disable]
end| Parameter Name | Description | Type | Size |
|---|---|---|---|
| status | Enable/disable the explicit Web proxy for HTTP and HTTPS session. enable: Enable the explicit web proxy. disable: Disable the explicit web proxy. |
option | - |
| ftp-over-http | Enable to proxy FTP-over-HTTP sessions sent from a web browser. enable: Enable FTP-over-HTTP sessions. disable: Disable FTP-over-HTTP sessions. |
option | - |
| socks | Enable/disable the SOCKS proxy. enable: Enable the SOCKS proxy. disable: Disable the SOCKS proxy. |
option | - |
| http-incoming-port | Accept incoming HTTP requests on one or more ports (0 - 65535, default = 8080). | user | Not Specified |
| https-incoming-port | Accept incoming HTTPS requests on one or more ports (0 - 65535, default = 0, use the same as HTTP). | user | Not Specified |
| ftp-incoming-port | Accept incoming FTP-over-HTTP requests on one or more ports (0 - 65535, default = 0; use the same as HTTP). | user | Not Specified |
| socks-incoming-port | Accept incoming SOCKS proxy requests on one or more ports (0 - 65535, default = 0; use the same as HTTP). | user | Not Specified |
| incoming-ip | Restrict the explicit HTTP proxy to only accept sessions from this IP address. An interface must have this IP address. | ipv4-address-any | Not Specified |
| outgoing-ip | Outgoing HTTP requests will have this IP address as their source address. An interface must have this IP address. | ipv4-address-any | Not Specified |
| ipv6-status | Enable/disable allowing an IPv6 web proxy destination in policies and all IPv6 related entries in this command. enable: Enable allowing an IPv6 web proxy destination. disable: Disable allowing an IPv6 web proxy destination. |
option | - |
| incoming-ip6 | Restrict the explicit web proxy to only accept sessions from this IPv6 address. An interface must have this IPv6 address. | ipv6-address | Not Specified |
| outgoing-ip6 | Outgoing HTTP requests will leave this IPv6. Multiple interfaces can be specified. Interfaces must have these IPv6 addresses. | ipv6-address | Not Specified |
| strict-guest | Enable/disable strict guest user checking by the explicit web proxy. enable: Enable strict guest user checking. disable: Disable strict guest user checking. |
option | - |
| pref-dns-result | Prefer resolving addresses using the configured IPv4 or IPv6 DNS server (default = ipv4). ipv4: Prefer the IPv4 DNS server. ipv6: Prefer the IPv6 DNS server. |
option | - |
| unknown-http-version | Either reject unknown HTTP traffic as malformed or handle unknown HTTP traffic as best as the proxy server can. reject: Reject requests with an unknown HTTP version. best-effort: Accept requests with an unknown HTTP version and use best efforts to handle the session. |
option | - |
| realm | Authentication realm used to identify the explicit web proxy (maximum of 63 characters). | string | Maximum length: 63 |
| sec-default-action | Accept or deny explicit web proxy sessions when no web proxy firewall policy exists. accept: Accept requests. All explicit web proxy traffic is accepted whether there is an explicit web proxy policy or not. deny: Deny requests unless there is a matching explicit web proxy policy. |
option | - |
| https-replacement-message | Enable/disable sending the client a replacement message for HTTPS requests. enable: Display a replacement message for HTTPS requests. disable: Do not display a replacement message for HTTPS requests. |
option | - |
| message-upon-server-error | Enable/disable displaying a replacement message when a server error is detected. enable: Display a replacement message when a server error is detected. disable: Do not display a replacement message when a server error is detected. |
option | - |
| pac-file-server-status | Enable/disable Proxy Auto-Configuration (PAC) for users of this explicit proxy profile. enable: Enable Proxy Auto-Configuration (PAC). disable: Disable Proxy Auto-Configuration (PAC). |
option | - |
| pac-file-url | PAC file access URL. | user | Not Specified |
| pac-file-server-port | Port number that PAC traffic from client web browsers uses to connect to the explicit web proxy (0 - 65535, default = 0; use the same as HTTP). | user | Not Specified |
| pac-file-name | Pac file name. | string | Maximum length: 63 |
| pac-file-data | PAC file contents enclosed in quotes (maximum of 256K bytes). | user | Not Specified |
| ssl-algorithm | Relative strength of encryption algorithms accepted in HTTPS deep scan: high, medium, or low. high: High encrption. Allow only AES and ChaCha. medium: Medium encryption. Allow AES, ChaCha, 3DES, and RC4. low: Low encryption. Allow AES, ChaCha, 3DES, RC4, and DES. |
option | - |
| trace-auth-no-rsp | Enable/disable logging timed-out authentication requests. enable: Enable logging timed-out authentication requests. disable: Disable logging timed-out authentication requests. |
option | - |
| Parameter Name | Description | Type | Size |
|---|---|---|---|
| status | Enable/disable policy. enable: Enable policy. disable: Disable policy. |
option | - |
srcaddr <name> |
Source address objects. Address name. |
string | Maximum length: 79 |
srcaddr6 <name> |
Source address6 objects. Address name. |
string | Maximum length: 79 |
dstaddr <name> |
Destination address objects. Address name. |
string | Maximum length: 79 |
| pac-file-name | Pac file name. | string | Maximum length: 63 |
| pac-file-data | PAC file contents enclosed in quotes (maximum of 256K bytes). | user | Not Specified |
| comments | Optional comments. | var-string | Maximum length: 1023 |
config web-proxy explicit
Description: Configure explicit Web proxy settings.
set status [enable|disable]
set ftp-over-http [enable|disable]
set socks [enable|disable]
set http-incoming-port {user}
set https-incoming-port {user}
set ftp-incoming-port {user}
set socks-incoming-port {user}
set incoming-ip {ipv4-address-any}
set outgoing-ip {ipv4-address-any}
set ipv6-status [enable|disable]
set incoming-ip6 {ipv6-address}
set outgoing-ip6 {ipv6-address}
set strict-guest [enable|disable]
set pref-dns-result [ipv4|ipv6]
set unknown-http-version [reject|best-effort]
set realm {string}
set sec-default-action [accept|deny]
set https-replacement-message [enable|disable]
set message-upon-server-error [enable|disable]
set pac-file-server-status [enable|disable]
set pac-file-url {user}
set pac-file-server-port {user}
set pac-file-name {string}
set pac-file-data {user}
config pac-policy
Description: PAC policies.
edit <policyid>
set status [enable|disable]
set srcaddr <name1>, <name2>, ...
set srcaddr6 <name1>, <name2>, ...
set dstaddr <name1>, <name2>, ...
set pac-file-name {string}
set pac-file-data {user}
set comments {var-string}
next
end
set ssl-algorithm [high|medium|...]
set trace-auth-no-rsp [enable|disable]
end| Parameter Name | Description | Type | Size |
|---|---|---|---|
| status | Enable/disable the explicit Web proxy for HTTP and HTTPS session. enable: Enable the explicit web proxy. disable: Disable the explicit web proxy. |
option | - |
| ftp-over-http | Enable to proxy FTP-over-HTTP sessions sent from a web browser. enable: Enable FTP-over-HTTP sessions. disable: Disable FTP-over-HTTP sessions. |
option | - |
| socks | Enable/disable the SOCKS proxy. enable: Enable the SOCKS proxy. disable: Disable the SOCKS proxy. |
option | - |
| http-incoming-port | Accept incoming HTTP requests on one or more ports (0 - 65535, default = 8080). | user | Not Specified |
| https-incoming-port | Accept incoming HTTPS requests on one or more ports (0 - 65535, default = 0, use the same as HTTP). | user | Not Specified |
| ftp-incoming-port | Accept incoming FTP-over-HTTP requests on one or more ports (0 - 65535, default = 0; use the same as HTTP). | user | Not Specified |
| socks-incoming-port | Accept incoming SOCKS proxy requests on one or more ports (0 - 65535, default = 0; use the same as HTTP). | user | Not Specified |
| incoming-ip | Restrict the explicit HTTP proxy to only accept sessions from this IP address. An interface must have this IP address. | ipv4-address-any | Not Specified |
| outgoing-ip | Outgoing HTTP requests will have this IP address as their source address. An interface must have this IP address. | ipv4-address-any | Not Specified |
| ipv6-status | Enable/disable allowing an IPv6 web proxy destination in policies and all IPv6 related entries in this command. enable: Enable allowing an IPv6 web proxy destination. disable: Disable allowing an IPv6 web proxy destination. |
option | - |
| incoming-ip6 | Restrict the explicit web proxy to only accept sessions from this IPv6 address. An interface must have this IPv6 address. | ipv6-address | Not Specified |
| outgoing-ip6 | Outgoing HTTP requests will leave this IPv6. Multiple interfaces can be specified. Interfaces must have these IPv6 addresses. | ipv6-address | Not Specified |
| strict-guest | Enable/disable strict guest user checking by the explicit web proxy. enable: Enable strict guest user checking. disable: Disable strict guest user checking. |
option | - |
| pref-dns-result | Prefer resolving addresses using the configured IPv4 or IPv6 DNS server (default = ipv4). ipv4: Prefer the IPv4 DNS server. ipv6: Prefer the IPv6 DNS server. |
option | - |
| unknown-http-version | Either reject unknown HTTP traffic as malformed or handle unknown HTTP traffic as best as the proxy server can. reject: Reject requests with an unknown HTTP version. best-effort: Accept requests with an unknown HTTP version and use best efforts to handle the session. |
option | - |
| realm | Authentication realm used to identify the explicit web proxy (maximum of 63 characters). | string | Maximum length: 63 |
| sec-default-action | Accept or deny explicit web proxy sessions when no web proxy firewall policy exists. accept: Accept requests. All explicit web proxy traffic is accepted whether there is an explicit web proxy policy or not. deny: Deny requests unless there is a matching explicit web proxy policy. |
option | - |
| https-replacement-message | Enable/disable sending the client a replacement message for HTTPS requests. enable: Display a replacement message for HTTPS requests. disable: Do not display a replacement message for HTTPS requests. |
option | - |
| message-upon-server-error | Enable/disable displaying a replacement message when a server error is detected. enable: Display a replacement message when a server error is detected. disable: Do not display a replacement message when a server error is detected. |
option | - |
| pac-file-server-status | Enable/disable Proxy Auto-Configuration (PAC) for users of this explicit proxy profile. enable: Enable Proxy Auto-Configuration (PAC). disable: Disable Proxy Auto-Configuration (PAC). |
option | - |
| pac-file-url | PAC file access URL. | user | Not Specified |
| pac-file-server-port | Port number that PAC traffic from client web browsers uses to connect to the explicit web proxy (0 - 65535, default = 0; use the same as HTTP). | user | Not Specified |
| pac-file-name | Pac file name. | string | Maximum length: 63 |
| pac-file-data | PAC file contents enclosed in quotes (maximum of 256K bytes). | user | Not Specified |
| ssl-algorithm | Relative strength of encryption algorithms accepted in HTTPS deep scan: high, medium, or low. high: High encrption. Allow only AES and ChaCha. medium: Medium encryption. Allow AES, ChaCha, 3DES, and RC4. low: Low encryption. Allow AES, ChaCha, 3DES, RC4, and DES. |
option | - |
| trace-auth-no-rsp | Enable/disable logging timed-out authentication requests. enable: Enable logging timed-out authentication requests. disable: Disable logging timed-out authentication requests. |
option | - |
| Parameter Name | Description | Type | Size |
|---|---|---|---|
| status | Enable/disable policy. enable: Enable policy. disable: Disable policy. |
option | - |
srcaddr <name> |
Source address objects. Address name. |
string | Maximum length: 79 |
srcaddr6 <name> |
Source address6 objects. Address name. |
string | Maximum length: 79 |
dstaddr <name> |
Destination address objects. Address name. |
string | Maximum length: 79 |
| pac-file-name | Pac file name. | string | Maximum length: 63 |
| pac-file-data | PAC file contents enclosed in quotes (maximum of 256K bytes). | user | Not Specified |
| comments | Optional comments. | var-string | Maximum length: 1023 |