Kerio-tech Firewall6 Manual de usuario descargar pdf (Pagina 93)

7.5 Policy routing

If the LAN is connected to the Internet by multiple links with load balancing (see chapter 6.4),

it may be needed that one link is reserved for a certain traﬃc, leaving the rest of the load for

the other links. Such a measure is useful if it is necessary to keep important traﬃc swinging

(email traﬃc, the informational system, etc.), i.e. not slowed down by secondary or even

marginal traﬃc (web browsing, online radio channels, etc.). To meet this crucial requirement

of an enterprise data traﬃc, it is necessary to consider and employ, besides the destination IP

address, additional information when

routing packets from the LAN to the Internet, such as

source IP address, protocol, etc. This approach is called policy routing.

In WinRoute, policy routing can be deﬁned by conditions in traﬃc rules for Internet access

with IP address translation (NAT). This approach brings wide range of options helping to meet

all requirements for routing and network load balancing.

Note: Policy routing traﬃc rules are of higher priority than routes deﬁned in the

routing table

(see chapter 18.1).

Example: A link reserved for email traﬃc

Let us suppose that the ﬁrewall is connected to the Internet by two links with load balancing

with speed values of 4 Mbit/s and 8 Mbit/s. One of the links is connected to the provider where

the mailserver is also hosted. Therefore, it is desirable that all email traﬃc (SMTP, IMAP, POP3

protocols and their secured versions) is routed through this link.

Deﬁne the following traﬃc rules to meet these requirements:

• First rule deﬁnes that NAT is applied to email services and the Internet 4 Mbit interface

is used.

• The other rule is a general NAT rule with automatic interface selection (see chap-

ter 7.4).

Figure 7.30 Policy routing — a link reserved for email traﬃc

1 2 ... 88 89 90 91 92 93 94 95 96 97 98 ... 403 404

Sin comentarios

Kerio-tech Firewall6 Manual de usuario Pagina 93