Network Router User Manual

SmartSwitch Router User Reference Manual 213
Chapter 15: IP Policy-Based Forwarding Configuration Guide
Traffic from the premium customer is load balanced across two next-hop gateways in the
high-cost, high-availability network. If neither of these gateways is available, then packets
are forwarded based on dynamic routes learned via routing protocols.
Traffic from the standard customer always uses one gateway (200.1.1.1). If for some reason
that gateway is not available, packets from the standard customer are dropped.
The following is the IP policy configuration for the Policy Router in Figure 21:
Authenticating Users through a Firewall
You can define an IP policy that authenticates packets from certain users via a firewall
before accessing the network. If for some reason the firewall is not responding, the packets
to be authenticated are dropped. Figure 22 illustrates this kind of configuration.
Figure 22. Using an IP Policy to Authenticate Users Through a Firewall
interface create ip premium-customer address-netmask 10.50.1.1/16 port
et.1.1
interface create ip standard-customer address-netmask 11.50.1.1/16 port
et.1.2
acl premium-customer permit ip 10.50.0.0/16 any any any 0
acl standard-customer permit ip 11.50.0.0/16 any any any 0
ip-policy p1 permit acl premium-customer next-hop-list "100.1.1.1
100.1.1.2" action policy-first sequence 20
ip-policy apply interface premium-customer
ip-policy p2 permit acl standard-customer next-hop-list 200.1.1.1
action policy-only sequence 30
ip-policy apply interface standard-customer
full-timers
10.50.2.0/24
Servers
Rout
Firewall
Policy
Router
Router
contractors
10.50.1.0/24
11.1.1.1
12.1.1.1