Cabletron Systems 9032578-05 manual Firewall Load Balancing

Chapter 15: IP Policy-Based Forwarding Configuration Guide

Packets from users defined in the “contractors” group are sent through a firewall. If the firewall cannot be reached packets from the contractors group are dropped. Packets from users defined in the “full-timers” group do not have to go through the firewall.

The following is the IP policy configuration for the Policy Router in Figure 22:

interface create ip mls0 address-netmask 10.50.1.1/16 port et.1.1

acl contractors permit ip 10.50.1.0/24 any any any 0 acl full-timers permit ip 10.50.2.0/24 any any any 0

ip-policy access permit acl contractors next-hop-list 11.1.1.1 action policy-only

ip-policy access permit acl full-timers next-hop-list 12.1.1.1 action policy-first

ip-policy access apply interface mls0

Firewall Load Balancing

The next hop gateway can be selected by the following information in the IP packet: source IP, destination IP, or both the source and destination IP. Figure 23 illustrates this configuration.

Intranet Internet

Firewalls

1.1.1.1 1 2.2.2.1

mls1	Policy
	Router 1
	1.1.1.5

		1					e
							t
		.						.
1								1
.				1.1.1.2		2.2.2.2				.
t					2						1
e		.2					et.1.2
	1
t.
e							.1
et.
	1.						et	.3
t			3	1.1.1.3		2.2.2.3			.4
e								1
.
1							.
	.				3		et
	4

Policy Router 2

2.2.2.5

mls2

1.1.1.44 2.2.2.4

Figure 23. Selecting Next Hop Gateway from IP Packet Information

One session should always go to a particular firewall for persistence.

214 SmartSwitch Router User Reference Manual