Command-line reference

exit

Exits the user from the Forcepoint Protector CLI and returns to the login prompt or to a wrapper shell environment.

Show CLI help messages

help

This command displays all available commands with a small description for each. The list of available commands depends on the user's profile. All commands support the help argument. When used, the command displays a help message relevant to that command.

Forcepoint1# dns help
dns: Configure or show DNS server(s) Usage: dns [list | delall] dns [{add | del} <ipaddr>]

Accessing the basic configuration wizard

wizard

Opens the Forcepoint Protector Installation Wizard. The user can also run wizard securecomm to go directly to the registration stage of the Wizard, where Data Security Manager details are entered.

Forcepoint1# wizard securecomm

Forcepoint1# wizard

Rebooting the protector

reboot

Reboots the protector. The protector is shut down and restarted immediately after the command is executed.

Turning off the protector

shutdown

Shuts down the protector. The protector is shut down and powered off immediately after the command is executed.

Showing the Forcepoint Protector version

version

Displays the protector version information.

Forcepoint1# version
This is Forcepoint Content Protector 8.6.0.009, Policy Engine 8.6.0.9 (Appliance 8.6.0.009)

Setting or showing the system date

date [-d] [dd-mmm-yyyy]

Sets or displays the date of the protector. By default, the command displays the current date. Otherwise, the argument is used to set the date of the protector.

The "date" command is also a native Linux command. Root users can access the CLI command by running it with its full path:

/opt/websense/neti/bin/date

If the -d option is given, the date is displayed or set using an all digit format (mm/dd/yyyy, for example: 07/31/2017). Otherwise, a dd-mmm-yyyy format is used. dd is the day of the month [01 to 31] mmm is the month in abbreviated 3-letter format [Jan, Feb, Mar, etc.] yyyy is the year [2016, 2017]

Forcepoint1# date
31-Jul-2017

Setting or showing the system time

time -h [HH[:MM[:SS]]]

Sets or displays the time in the protector. By default, the command displays the current time.

The "time" command is also a native Linux command. Root users can access the CLI command by running it with its full path:

/opt/websense/neti/bin/time

-u sets the time in UTC

-h displays a short usage message HH:MM:SS HH is the hour [00 to 24]

MM is the minutes [00 to 59]

SS is the seconds [00 to 59]

Forcepoint1# time
17:55:03

Modify or show system time zone

timezone [list, show, set <timezone>]

Shows or sets the protector time zone.

When no argument is given, "show" is assumed.

list displays a complete list of time zones that can be set in the Forcepoint Protector

show displays the time zone set in the Forcepoint Protector (default option)

set <timezone> sets the time zone. The set command must be followed by the name of the time zone to be selected, as listed using the list command. Note that the names of the time zones are case-sensitive.

Default

Forcepoint1# timezone set US/Hawaii

Viewing protector information

info { cpu | memory | network | diag | uptime | hardware | features} info stats [reset]

Displays information about the Forcepoint protector.

Root users must access the CLI command by running it with its full path:

/opt/websense/neti/bin/info

cpu displays the protector's CPU usage information.

memory displays the protector memory usage information.

network displays the protector's network settings including hostname, domain name, IP address and routing table.

diag creates a diagnostic file to be used by Forcepoint technical services.

uptime displays the amount of time the protector has been up and operational.

features lists all the possible features available on this protector and what they can do (monitor or block).

hardware displays hardware information including which network cards are installed.

stats displays traffic statistics for each protocol being monitored; this is useful to verify the operational status of the Protector.

stats reset resets all statistics counters to zero.

Forcepoint1# info cpu
Processor 1: 1.3% loaded (98.7% idle)

Forcepoint1# info memory
Free physical memory 8.7%

Collecting statistics

debug stats [-d] [-i <interval> | -n <count>]

opt/pa/log/collect_stats.csv.gz

This command allows a user to collect statistics about network behavior over time. It does so by running info stats at specified intervals for a given number of times. The collected statistics are saved in a CSV file for easy manipulation and analysis in spreadsheet tools such as Microsoft Excel. The resulting file is saved as:

The default interval is every 60 seconds. The default number is 1440 (which is the equivalent of 24 hours of statistics when the default interval of 60 is selected).

-d: delete previously recorded statistics information file, if one exists

interval: the interval in seconds between two runs that take a snapshot of the statistics.

count: how many times the statistics snapshot should be taken.

Default

Forcepoint# debug stats -d -i 120

Configure or show the DNS server(s)

dns [list | delall] dns [{add | del}] <ip_address>]

Lists, adds, or deletes DNS servers.

list: displays a list of DNS servers in the protector

delall: deletes all DNS servers set in the protector

add: adds a DNS server specified by its IP address to the protector

del: deletes the DNS server denoted by the specified IP address

Forcepoint1# dns add 192.168.15.3

Configure or show the default domain name(s)

domain [list | delall] domain [{add (-m) | del} <domain>]

Lists, adds, or deletes default domain names in the protector.

list: displays a list of configured default domain names in the protector

delall: deletes all default domain names set in the protector

add: adds a default domain name specified by <domain> to the protector

Use the -m switch to set a domain as main. The main domain is the domain that the protector is actually is a member of. Without the 1m switch a search domain is created. For the protector to resolve a domain this domain is searched as well. There may be many search domains, but only one main domain.

del: deletes the default domain name denoted by <domain> from the protector

Forcepoint1# domain add example.com

Configure or show the default gateway

gateway <ip_address>

gateway [list | delete]

By default, displays the current defined gateway. Using the parameters, it is possible to set or delete the default gateway of the protector.

If this command is run from a remote SSH session, the session may terminate.

ipaddr: when given, the ipaddr is used as a default gateway for the protector.

list: shows the configured default gateway.

delete: deletes the defined default gateway.

Forcepoint1# gateway 192.168.10.254

Configure or show the hostname

hostname <name>

Displays the current hostname. The parameter can also set a unique name by which to identify the protector.

If a name is given, the hostname is set to the given name. Otherwise, the hostname is displayed.

Forcepoint1# hostname 1Tokyo

Configure or show interface information

iface ifname [ip <ip_address>] [prefix <prefix>] [bcast <bcastaddr>] [speed <speed>] [duplex <duplex>] [mgmt] [enable|disable] [descr <description>]

iface [list]

Configures and displays the protector's network interface information. When invoked without arguments or with the list option, the command displays a list of all available interfaces in the system. When invoked with only an interface name, the command shows detailed information about that interface. Any other invocation method configures the interface denoted in ifname.


	Note Use a console connection to the protector when using this command to configure the management interface, (and not a remote SSH connection). Using the latter may terminate the session to the protector. In addition, if the IP address is changed, it may be required to re-establish secure communication with the Forcepoint DLP server (by re-running the configuration wizard).

ip: the IP address assigned to the interface. This option is valid only for the management interface. When setting ip, the prefix and bcast options must also be set.

prefix: network mask of the interface. For example: 24 (will assign 255.255.255.0 mask to the interface)

bcast: broadcast address of the interface. For example: for an interface with the IP address 192.168.1.1/24, the broadcast address is usually 192.168.1.255.

speed: interface link speed. Available speeds: auto, 10, 100, 1000

duplex: interface link duplex. Available duplex options: auto, half, full

mgmt: sets the interface as the management interface of the protector. The previously defined management interface can no longer be used for management purposes.

enable, disable: enables or disables the interface (default is enable)

descr: assigns a short description for the interface. Note that if the description contains spaces, it must be enclosed within quotation marks ("").

Default

eth0

Forcepoint1# iface eth0 ip 10.100.16.20 prefix 24 bcast 10.100.16.255 mgmt enable

Add or delete routing information

route add {destination network | destination ip} {via ip | dev device}

route list

route del {destination network | destination ip} {via ip | dev device}

Adds or deletes route entries in the protector. When adding or deleting routes to networks, use the x.x.x.x/prefix format. For example: 192.168.1.0/24.

list: displays the protector's routing table

add: adds a route to a network or IP address

del: deletes a route to a network or IP address

Forcepoint1# route add 100.20.32.0/24 via 10.16.10.10

Forcepoint1# route add 172.16.1.0/24 dev eth0

Manage users

user add {username} profile {profile} pwd {password}

user del {username}

user mod {username} [profile {profile}] [pwd {new password}]
user list

Use the "user" command to define additional system access accounts. Each account has a profile that defines the operations available to users.

The available profiles are:

admin: all commands are allowed

netadmin: only networking related commands are allowed

policyadmin: only the policy command is allowed

The list of commands each profile can run cannot be changed.

add: add a user with the given profile and password

del: delete a user

mod: modify a user's profile and/or password

list: display a list of all defined users and their profiles

Forcepoint1# user add Jonny profile netadmin pwd 123qwe

Filtering monitored networks

Use the Forcepoint Management Interface to define which networks are monitored by the protector.

This CLI command enables advanced filtering of monitored networks.


	Note Forcepoint recommends testing the filter using tcpdump before setting the filter. This ensures that the protector recognizes the filter expression.

filter [show | set rule | delete]

show: displays the current active filters - monitored networks

set: defines a list of monitored networks

delete: deletes previously set filter rules