Cabletron Systems 9032578-05 manual Authenticating Users through a Firewall

Chapter 15: IP Policy-Based Forwarding Configuration Guide

Traffic from the premium customer is load balanced across two next-hop gateways in the high-cost, high-availability network. If neither of these gateways is available, then packets are forwarded based on dynamic routes learned via routing protocols.

Traffic from the standard customer always uses one gateway (200.1.1.1). If for some reason that gateway is not available, packets from the standard customer are dropped.

The following is the IP policy configuration for the Policy Router in Figure 21:

interface create ip premium-customer address-netmask 10.50.1.1/16 port et.1.1

interface create ip standard-customer address-netmask 11.50.1.1/16 port et.1.2

acl	premium-customer permit ip	10.50.0.0/16 any any any 0
acl	standard-customer permit	ip 11.50.0.0/16 any any any 0

ip-policy p1 permit acl premium-customer next-hop-list "100.1.1.1 100.1.1.2" action policy-first sequence 20

ip-policy apply interface premium-customer

ip-policy p2 permit acl standard-customer next-hop-list 200.1.1.1 action policy-only sequence 30

ip-policy apply interface standard-customer

Authenticating Users through a Firewall

You can define an IP policy that authenticates packets from certain users via a firewall before accessing the network. If for some reason the firewall is not responding, the packets to be authenticated are dropped. Figure 22 illustrates this kind of configuration.

contractors 10.50.1.0/24

11.1.1.1

Policy

12.1.1.1 Router

full-timers

10.50.2.0/24

Firewall

Router

Rout

Servers

Figure 22. Using an IP Policy to Authenticate Users Through a Firewall

SmartSwitch Router User Reference Manual 213