The following sections describe basic management interface and global network configuration settings.
Management interface settings
The following list describes the management interface configuration settings.
IP Version—The appliance has dual-stack support for Internet Protocol version 4 (IPv4) and version 6 (IPv6) on the management interface.
DHCP—Dynamic Host Configuration Protocol (DHCP) dynamically distributes network configuration parameters. If DHCP is disabled on the management interface, you must manually configure the IP address, subnet mask, and default gateway or next-hop device.
IP Address—The IPv4 or IPv6 address of the management interface. Both types of addresses can be configured. The IPv4 address is enabled by default. You must explicitly enable the IPv6 address.
Subnet Mask—The network portion of the IP address. For example, 255.255.255.0 indicates that the first 24 bits of an IPv4 address are used for the network portion of the address.
Default Gateway—For an IPv4 address, the IPv4 address of the default router. For an IPv6 address, the IPv6 address of the default router or next-hop device.
Autoconf Enabled—When Stateless Address Autoconfiguration (SLAAC) is enabled, an IPv6 address is automatically assigned for the interface. The address is based on an IPv6 prefix learned from router advertisements, combined with an interface identifier based on the MAC address of the interface.
Autoconf Route—When this feature is enabled, the system learns a default route from the automatically assigned IPv6 address.
Autoconf Privacy—When this feature is enabled, the system generates random host identifiers (known as privacy extensions) to construct the IPv6 address. This provides more security when communicating with remote hosts.
Global network settings
The following list describes global network configuration settings.
DNS Servers—Domain Name System (DNS) servers translate domain names to IP addresses for routing. At least one DNS server is required. You can optionally configure a secondary DNS server that is used when the primary server is unavailable or cannot resolve a domain name. You can view a list of DNS servers that will be traversed for DNS resolution, in order, from top to bottom. Only active DNS servers are listed. If neither DNS server can resolve the domain name, an error is displayed.
Domain Names—The domain names the DNS servers resolve to IP addresses. You can view a list of domain names in order, from top to bottom.
Hostname—The hostname of the appliance (for example, dc-01). You can include the domain (for example, dc-01.acme.com).
IPv6—You can enable or disable IPv6 routing on the system, on the management interface, or both. IPv6 must be enabled on the Network Security appliances that are members of a Network Security High Availability (HA) pair. It is enabled automatically by the Central Management System appliance that manages the HA pair.
VPN—You can enable or disable virtual private networking (VPN) on the system. When VPN is enabled, the appliance can connect to Managed Defense over the Internet using a secure SSL VPN connection. VPN requires a valid MD_ACCESS license on the appliance. VPN requires IPv6 routing, so IPv6 must be enabled on the system before you can enable VPN. For more information, see the Managed Defense Quick Start Guide.
Operator or Admin access
Configuring basic network settings using the Web UI
Use the Network Settings page to configure basic network settings for the Network Security appliance. For a description of the information and settings on this page, see Basic network configuration .
Viewing management interface detail settings
Use the Interface Details section to view the configuration of the management interface. This is a read-only section. The management interface is configured during the initial configuration, and can be modified later using the CLI. For details, see Initial configuration or the CLI Command Reference.
.png)
Click the Settings tab.
Select Network on the sidebar.
Locate the Interface Details section at the top of the page.
Configuring DNS servers
Use the Configure DNS Server Addresses section to configure DNS server addresses.
.png)
Click the Settings tab.
Click the Appliance Settings subtab.
Select Network on the sidebar.
In the Configure DNS Server Addresses section, enter the IP address of the primary DNS server.
(Optional) Enter the IP address of a secondary DNS server.
Click Apply.
The order in which the DNS servers are traversed is displayed in the DNS Resolution order list. An error message is displayed if no server is active.
Configuring domain names
Use the Configure Domain Names section to add or remove domain names.
.png)
Click the Settings tab.
Click the Appliance Settings subtab.
Select Network on the sidebar.
In the Configure Domain Names section, click Add Domain Name.
Enter a domain name, click Add.
.png)
Repeat the previous steps to configure additional domain names.
The order in which the domain names are traversed is displayed in the Domain Names Resolution order list.
Locate the domain name you want to delete.
Click the Delete (trash can) icon in the Delete column for each domain name you want to remove.
Click YES.
The domain name is deleted from the configuration.
Close the message.
Enabling IPv6
Use the Configure IPv6 section to enable or disable IPv6 routing. You can also use this section to enable or disable IPv6 on the SMTP interface.
Click the Settings tab.
Click the Appliance Settings subtab.
Select Network on the sidebar.
Enable IPv6:
To enable IPv6 routing on the system, select the Global IPv6 checkbox, and then click Apply.
To enable IPv6 on the management interface, select the Management Interface IPv6 checkbox, and then click Apply.
Click the Settings tab.
Select Network on the sidebar.
Disable IPv6:
To disable IPv6 routing on the system, clear the Global IPv6 checkbox, and then click Apply.
To disable IPv6 on the management interface, clear the Management Interface IPv6 checkbox, and then click Apply.
Enabling VPN
The VPN Settings section appears at the bottom of the page if a valid MD_ACCESS license is installed. You can enable VPN only when IPv6 is enabled on the system. For details, see the Managed Defense Quick Start Guide.
Note
VPN support for HX Series appliances should not be enabled except by Managed Defense.
Configuring basic network settings using the CLI
Use the commands in this topic to configure the network settings manually.
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
To disable DHCP for the interface:
hostname (config) # no interface ether1 dhcp
Note
If you use DHCP and there is no network connection for the management interface, do the following:
Restore the network connection.
Disable DHCP.
Enable DHCP.
Set the interface IP address and network mask. For example:
hostname (config) # interface ether1 ip address 1.1.1.1 255.240.0.0
Specify the default gateway. For example:
hostname (config) # ip default-gateway 1.1.1.2 ether1
Specify a DNS server. For example:
hostname (config) # ip name-server 10.10.20.5
Save your changes.
hostname (config) # write memory