Network security appliances

# Configure WAN interface
vw-network interface set wan1 \
  --mode dhcp \
  --mtu 1500

# Configure LAN interface
vw-network interface set lan1 \
  --ip 10.0.0.1 \
  --netmask 255.255.255.0 \
  --dhcp-server enable \
  --dhcp-range 10.0.0.100-10.0.0.200

# Configure DMZ interface
vw-network interface set dmz1 \
  --ip 172.16.0.1 \
  --netmask 255.255.255.0

# Configure IPsec tunnel
vw-vpn ipsec create \
  --name "Branch Office" \
  --local-gateway 203.0.113.10 \
  --remote-gateway 198.51.100.20 \
  --local-network 10.0.0.0/24 \
  --remote-network 10.1.0.0/24 \
  --psk "your-pre-shared-key" \
  --encryption aes256 \
  --authentication sha256 \
  --dh-group 14

# Enable the tunnel
vw-vpn ipsec enable "Branch Office"

# Configure SSL VPN
vw-vpn ssl configure \
  --port 443 \
  --ip-pool 10.10.0.0/24 \
  --dns 8.8.8.8,8.8.4.4 \
  --split-tunnel enable \
  --routes 10.0.0.0/8,172.16.0.0/12

# Add VPN user
vw-vpn ssl user add \
  --username john.doe \
  --password "secure-password" \
  --2fa enable \
  --groups remote-workers

# Generate client configuration
vw-vpn ssl client-config \
  --user john.doe \
  --output john-doe-vpn.ovpn

# Initialize WireGuard
vw-vpn wireguard init \
  --interface wg0 \
  --port 51820 \
  --address 10.20.0.1/24

# Add peer
vw-vpn wireguard peer add \
  --name "Mobile Device" \
  --public-key "peer-public-key" \
  --allowed-ips 10.20.0.2/32 \
  --persistent-keepalive 25

# Show configuration
vw-vpn wireguard show wg0

# Enable IPS engine
vw-ips enable \
  --mode prevention \
  --interfaces wan1,dmz1

# Update signatures
vw-ips update-signatures

# Configure IPS policy
vw-ips policy set \
  --profile high-security \
  --block-severity high,critical \
  --alert-severity medium \
  --log-all true

# Create custom rule
vw-ips rule create \
  --name "Block SQL Injection" \
  --pattern "union.*select|select.*from.*where" \
  --protocol http \
  --action block \
  --severity high

# Import Snort rules
vw-ips import-rules \
  --format snort \
  --file custom-rules.rules

# Enable web filtering
vw-webfilter enable \
  --mode proxy \
  --port 8080

# Block categories
vw-webfilter category block \
  --categories adult,gambling,malware,phishing

# Allow specific sites
vw-webfilter whitelist add \
  --url example.com \
  --comment "Corporate website"

# Block specific sites
vw-webfilter blacklist add \
  --url badsite.com \
  --comment "Known malware distributor"

# Enable SSL inspection
vw-webfilter ssl-inspection enable \
  --ca-cert /etc/vaultwares/ca.crt \
  --ca-key /etc/vaultwares/ca.key

# Exclude sites from inspection
vw-webfilter ssl-inspection exclude \
  --domains banking.com,healthcare.gov \
  --reason "Privacy/compliance"

# Initialize HA on primary
vw-ha init \
  --role primary \
  --peer-ip 192.168.100.2 \
  --sync-interface ha0 \
  --virtual-ip 203.0.113.100 \
  --password "ha-sync-password"

# Initialize HA on secondary
vw-ha init \
  --role secondary \
  --peer-ip 192.168.100.1 \
  --sync-interface ha0 \
  --password "ha-sync-password"

# Verify HA status
vw-ha status

# Output:
# HA Status: Active
# Role: Primary
# Peer Status: Online
# Sync Status: In Sync
# Failover: Ready

# Trigger manual failover
vw-ha failover --force

# Monitor failover
vw-ha monitor --live

# View live traffic
vw-monitor traffic --interface wan1 --live

# View active sessions
vw-monitor sessions --top 20

# View threat dashboard
vw-monitor threats --last 24h

# Configure syslog
vw-logging syslog add \
  --server syslog.example.com \
  --port 514 \
  --protocol udp \
  --facility local0

# Configure SIEM integration
vw-logging siem configure \
  --type splunk \
  --server splunk.example.com:8088 \
  --token "your-hec-token" \
  --format json

# Export logs
vw-logging export \
  --start-date "2024-01-01" \
  --end-date "2024-01-31" \
  --format csv \
  --output firewall-logs.csv

# Configure QoS
vw-qos policy create \
  --name "VoIP Priority" \
  --interface wan1 \
  --priority high \
  --bandwidth-guarantee 2Mbps \
  --protocol udp \
  --ports 5060-5061,10000-20000

# Bandwidth limits
vw-qos limit set \
  --interface wan1 \
  --upload 100Mbps \
  --download 500Mbps \
  --per-user-limit 10Mbps

# Enable connection pooling
vw-optimize connection-pool enable \
  --max-connections 1000000 \
  --timeout 3600

# Enable TCP optimization
vw-optimize tcp \
  --window-scaling enable \
  --selective-ack enable \
  --timestamps enable

# Create backup
vw-backup create \
  --output /backup/vaultgate-$(date +%Y%m%d).tar.gz \
  --encrypt \
  --password "backup-password"

# Automated backups
vw-backup schedule \
  --frequency daily \
  --time 02:00 \
  --retention 30days \
  --destination sftp://backup.example.com/vaultgate/

# Restore from backup
vw-backup restore \
  --input /backup/vaultgate-20240115.tar.gz \
  --password "backup-password" \
  --reboot