ZyWALL 5/35/70 Series User’s Guide

CH A P T E R 24

Policy Route

This chapter covers setting and applying policies used for IP routing. This chapter applies to the ZyWALL 35 and ZyWALL 70.

24.1 Policy Route

Traditionally, routing is based on the destination address only and the ZyWALL takes the shortest path to forward a packet. IP Policy Routing (IPPR) provides a mechanism to override the default routing behavior and alter the packet forwarding based on the policy defined by the network administrator. Policy-based routing is applied to incoming packets on a per interface basis, prior to the normal routing.

24.2Benefits

•Source-Based Routing – Network administrators can use policy-based routing to direct traffic from different users through different connections.

•Quality of Service (QoS) – Organizations can differentiate traffic by setting the precedence or ToS (Type of Service) values in the IP header at the periphery of the network to enable the backbone to prioritize traffic.

•Cost Savings – IPPR allows organizations to distribute interactive traffic on high- bandwidth, high-cost paths while using low-cost paths for batch traffic.

•Load Sharing – Network administrators can use IPPR to distribute traffic among multiple paths.

24.3Routing Policy

Individual routing policies are used as part of the overall IPPR process. A policy defines the matching criteria and the action to take when a packet meets the criteria. The action is taken only when all the criteria are met. The criteria include the source address and port, IP protocol (ICMP, UDP, TCP, etc.), destination address and port, ToS and precedence (fields in the IP header) and length. The inclusion of length criterion is to differentiate between interactive and bulk traffic. Interactive applications, e.g., telnet, tend to have short packets, while bulk traffic, e.g., file transfer, tends to have large packets.

The actions that can be taken include:

•Routing the packet to a different gateway (and hence the outgoing interface).

•Setting the ToS and precedence fields in the IP header.

Chapter 24 Policy Route

392