traffic-proxy
- service traffic-proxy <id>
- Devices
- Values:
id – Traffic proxy service
- Instances:
Multiple
- Required:
- Required:
- Required:
- service traffic-proxy <id> block
- Devices
HTTP block page configuration
- service traffic-proxy <id> block rule <u32>
- Devices
- Values:
u32 – Block rules based on connections marks
- Instances:
Multiple
- Required:
- service traffic-proxy <id> block rule <u32> connmark
- Devices
Connection connmark matching configuration
- Instances:
Unique
- service traffic-proxy <id> block rule <u32> connmark extra-mark <int>
- Devices
Match against extended connmark (emark1)
- Values:
1 – Extra mark 1 (emark2 is reserved)
- Instances:
Multiple
- service traffic-proxy <id> block rule <u32> connmark extra-mark <int> value <u32>
- Devices
- Values:
u32 – Value to match against extra connmark
- service traffic-proxy <id> block rule <u32> connmark mark <u32>
- Devices
- Values:
u32 – Match against connmark
- service traffic-proxy <id> block rule <u32> connmark vrf-mark <id>
- Devices
Match against connmark using a VRF
- Reference:
- service traffic-proxy <id> block rule <u32> set
- Devices
Variables overrides for this rule
- service traffic-proxy <id> block rule <u32> set variable <id>
- Devices
- Values:
id – Variables to override when this rule matches
- Instances:
Multiple
- service traffic-proxy <id> block rule <u32> set variable <id> value <txt>
- Devices
- Values:
txt – Override value for this rule
- service traffic-proxy <id> block template
- Devices
Block page template configuration
- service traffic-proxy <id> block template file <file>
- Devices
- Values:
file – HTML template file with placeholders
- service traffic-proxy <id> block template variable <id>
- Devices
- Values:
id – Template variable with default values
- Instances:
Multiple
- service traffic-proxy <id> block template variable <id> value <txt>
- Devices
- Values:
txt – Default value for the variable
- service traffic-proxy <id> disable-ssl-compression
- Devices
Disable SSL/TLS compression on all connections
This option is useful when the limiting factor is CPU, not network bandwidth
- service traffic-proxy <id> hash-table-size <u32>
- Devices
Size of hash-table to use for SSL flow tracking
- Values:
u32 – Number of elements (4096-65536)
- service traffic-proxy <id> hash-table-timeout <u32>
- Devices
Timeout of entries in hash-table
- Values:
u32 – Timeout in seconds (10-3600)
- service traffic-proxy <id> local-vrf <id>
- Devices
VRF to run traffic proxy on
- Reference:
- service traffic-proxy <id> logging
- Devices
Enable event logging
- service traffic-proxy <id> logging connection
- Devices
Log information about new connections
- service traffic-proxy <id> logging content
- Devices
Log information about decrypted content
- service traffic-proxy <id> logging queue
- Devices
Show a log in the journal every time a new packet is enqueued
- service traffic-proxy <id> mark <u32>
- Devices
Mark diverted packets
- Values:
u32 – Integer value from 0 to 2147483647 (0-2147483647)
- service traffic-proxy <id> mode <id>
- Devices
Proxy operating mode
- Values:
https – Decode HTTP connection, including the removal of HPKP, HSTS, Upgrade and Alternate Protocol
pop3s – Decode POP3 connection
smtps – Decode SMTP connection
ssl – Do not decode SSL connection, decrypted connection content is treated as opaque stream of bytes
http – Decode plain HTTP connection
pop3 – Decode plain POP3 connection
smtp – Decode plain STMP connection
tcp – Do not decode TCP connection, decrypted connection content is treated as opaque stream of bytes
autossl – Do not decode SSL connection, work as protocol-independent STARTTLS support
- service traffic-proxy <id> port <u32>
- Devices
Local port to use to intercept traffic
- Values:
u32 – Numeric port (1-65535)
- service traffic-proxy <id> queue <txt>
- Devices
Traffic queue where decrypted/decoded packets will be sent
- Reference:
- service traffic-proxy <id> vrf-mark <id>
- Devices
Mark diverted packets using a VRF
- Reference:
- service traffic-proxy <id> x509
- Devices
X.509 configuration parameters
- service traffic-proxy <id> x509 ca-cert <file>
- Devices
- Values:
file – CA certificate in PEM format to issue certificates forged on-the-fly
- service traffic-proxy <id> x509 ca-key <file>
- Devices
- Values:
file – CA private key in PEM format to issue certificates forged on-the-fly
- service traffic-proxy <id> x509 dhparam <file>
- Devices
- Values:
file – Diffie-Hellman parameters in PEM format
- service traffic-proxy <id> x509 leaf-crl-url <id>
- Devices
- Values:
id –
URL to use as CRL distribution point
CRL for all forged certificates
- service traffic-proxy <id> x509 leaf-key-size <u32>
- Devices
- Values:
u32 – Keysize in bits for leaf key RSA