You can determine what addresses have already been assigned to systems via DHCP using a command in the form get interface <interface> dhcp server ip allocate where interface is a particular interface, e.g., trust, untrust, etc.

ns5xp-> get interface trust dhcp server ip allocate
       IP         	State	     MAC     	Lease Time
 192.168.0.34   	COMMIT	*000d560e185e	3236 minutes
 192.168.0.35   	COMMIT	*4c72b99cb82a	3925 minutes
ns5xp->

If I wished to assign the IP address 192.168.0.7 to the system above with MAC address 4c72b99cb82a, I could use the command below:

set interface trust dhcp server ip 192.168.0.7 mac 4c72b99cb82a

[ More Info ]

[/security/firewalls/netscreen] permanent link

I verified that I could connect to the email server on the SMTP port, port 25, and the POP3 port, port 110, from external systems and she told me that her husband's system was able to check his email successfully. Since I knew his system was establishing a POP3 connection to the mail server to check email, but her system was establishing an encrypted POP3S connection on port 995, I checked the Linux email server to verify that it was listening for connections on port 995, since there had been a power outage at its location recently that I thought might have caused it to reboot. It was listening on that port.

$ netstat -a | grep -i pop3s
tcp        0      0 0.0.0.0:pop3s           0.0.0.0:*               LISTEN     
tcp6       0      0 [::]:pop3s              [::]:*                  LISTEN

So I thought the problem was likely at a NetScreen firewall between the user and the server. I logged into the firewall via Secure Shell (SSH). I verified that there were no filters currently set for the firewall and then set a filter for destination port 995 with the command set ffilter dst-port 995. I then cleared the debug buffer with clear db and started debugging on the router/firewall with debug flow basic - see NetScreen Debugging Commands for an explanation of the debugging commands. I could see that TCP packets were reaching the firewall, but the firewall was reporting "packet dropped: for self but not interested".

[ More Info ]

[/security/firewalls/netscreen] permanent link

ns5gt-> get clock
Date 06/24/1997 07:43:02, Daylight Saving Time enabled
The Network Time Protocol is Disabled
Up 917 hours 27 minutes 27 seconds Since 17 May 1997 02:15:35
867138182.710668 seconds since 1/1/1970 0:0:0 GMT
GMT time zone area -5:00
GMT time zone offset 4:00
ns5gt->

In the above output, I can see that the date and time are not set correctly. I can see that the time offset from Greenwich Mean Time (GMT) is four hours, which is currently correct for this device, though. You can see the current GMT time as well as the times for many major cities throughout the world at The World Clock - Worldwide.

The set clock command can be used to set the date.

ns5gt-> set clock ?
mm/dd/yyyy           month/day/year
dst-off              disable daylight saving time
ntp                  enable network time protocol
timezone             GMT Time zone area
ns5gt->

You can specify the month, date, and year in the form mm/dd/yyyy . The time should be specified after the date in the form hh:mm or hh:mm:ss.

[ More Info ]

[/security/firewalls/netscreen] permanent link

I was using the rdesktop program on a Ubuntu Linux system to establish the connection to the Microsoft Windows system. After I realized my error regarding the destination IP address, I was able to establish the RDP connection, but then received a "Connect a smart card" message when I got to the login screen and clicked on the relevant account. I was able to log into the system, however, if I used the -p option with the rdesktop command to supply the password for an account on the Microsoft Windows system.

[ More Info ]

[/security/firewalls/netscreen] permanent link

set service "Auburn SSH" protocol tcp src-port 1024-65535 dst-port 2005-2005

The text in quotation marks immediately after set service is just a descriptive name you can give to the service to make the purpose of the custom service more immediately identifiable.

[ More Info ]

[/security/firewalls/netscreen] permanent link

[ More Info ]

[/security/firewalls/netscreen] permanent link

To view only those policies that apply to a particular service, such as FTP, I could use get policy from untrust to trust | include FTP.

ns5gt-> get policy from untrust to trust | include FTP
    24 Untrust  Trust    ACME VPN     VIP(untrust) FTP                  Permit enabled ---X-X
    25 Untrust  Trust    ACI          VIP(untrust) FTP                  Permit enabled ---X-X
ns5gt->

Steps are listed here that can be used to create a policy that will allow FTP connectivity from external systems to an internal FTP server behind the firewall.

[/security/firewalls/netscreen] permanent link

Traffic shaping is a mechanism to give certain types of data flows precedence over others with lower priority traffic being buffered. In this case I didn't actually "shape" the traffic, but just enabled traffic shaping mode so that I could see the current bandwidth being used on interfaces.

[ More Info ]

[/security/firewalls/netscreen] permanent link

The NTP configuration can also be viewed and set from a command line interface accessible by SSH using get ntp and set ntp commands. Up to three NTP servers can be configured. The time interval for NTP queries can be specified.

[ More Info ]

[/security/firewalls/netscreen] permanent link

[ More Info ]

[/security/firewalls/netscreen] permanent link