Configuring URL dynamic analysis using the CLI

Use the CLI commands in this topic to configure URL Dynamic Analysis (also called DUA).

To configure URL Dynamic Analysis:

Go to CLI configuration mode.

hostname > enable

hostname # configure terminal

Specify the live ether1 or ether2 interface.
hostname (config) # analysis live live-interface <interfaceName>
where <interfaceName> is the name of the live ether1 or ether2 data interface.
Specify the external IPv4 address and domain for the live ether1 or ether2 interface. You specify the domain by including the subnet mask (for example, 255.240.0.0) or the mask length.
```
hostname (config) # analysis live external ip <IP_Address> <subnet_mask>
```
Specify the IPv4 address of the default gateway for the live ether1 or ether2 interface.
```
hostname (config) # analysis live default-gateway ip <IP_address>
```
where <IP address> resides on the same network segment as the live ether1 or ether2 interface.
Note
If the live ether2 data interface is required, Trellix recommends that you keep the ether2 interface logically separate from the main network traffic so that the ether1 management interface resides on a different subnet from the ether2 interface. However, the URL Dynamic Analysis interface can be configured with an external IPv4 address in the same subnet range as the ether1 management interface.
Specify the IPv4 address of the DNS name server for the live ether1 or ether2 interface.
```
hostname (config) # analysis live nameserver ip <IP_address>
```
Check end-to-end connectivity between the live ether1 or ether2 interface and the Internet.
hostname (config) # analysis live check-connection
Verify the configuration settings for URL Dynamic Analysis.
```
hostname (config) # show analysis live config
```
Save your changes.
```
hostname (config) # write memory
```

Example

This example shows how to configure the live ether2 interface. The ether2 interface is connected to access the Internet directly. The Live Analysis Configuration section of the show analysis live config command output displays the configuration settings shared by URL Dynamic Analysis and controlled live mode.

hostname (config) # analysis live live-interface ether2

hostname (config) # analysis live external ip 172.16.0.0 /12

hostname (config) # analysis live default-gateway ip 172.16.1.1

hostname (config) # analysis live nameserver ip 172.16.2.1

hostname (config) # analysis live check-connection

hostname (config) # show analysis live config

   Malware Analysis Mode Enabled : yes

   Malware Download Timeout      : 120 (sec)

   Malware Analysis VMs          : 100 (percent)

   Live Analysis Configuration

Interface : ether2

     Default Gateway : 172.16.1.1

     External IP     : 172.16.0.0/12

     Internal IP     : 169.254.100.1/24

     Name Server     : 172.16.2.1

     Http Proxy      : 0.0.0.0:0

     Http Proxy Authentication: root/********

     Force Data Interface For Prefetch : no