Netgear XCM8806 Chassis User Manual - Page 338

NETGEAR 8800 User Manual Note: See Load Sharing Rules and Restrictions for All Switches on page 132 for information on applying ACLs to LAG ports. Layer 3 Policy-Based Redirect Policy-Based Routing allows you to bypass standard Layer 3 forwarding decisions for certain flows. Typically, in a Layer 3 environment, when an IP packet hits an Ethernet switch or router, the Layer 3 processing determines the next hop and outgoing interface for the packet, based only on the packet's destination address. The Layer 3 processing does so by looking up the IP Forwarding Table; this forwarding table itself is populated either by static routes or by routes learned dynamically from routing protocols such as OSPF and RIP. With Policy-Based Routing, you can configure policies to use a different nexthop than what the routing lookup would have chosen. The switch first compares packets to the ACL rule entries. If there is a match, the packet is forwarded to the destination identified by the redirect action modifier. If there is no match, the packet is forwarded based on normal routing, in other words, by looking up a route in the IP Forwarding Table. When there is a match with a redirect ACL rule, the matched traffic will be redirected to the nexthop specified in the action. Note that the IP packet itself will not be modified, but only redirected to the port where the nexthop entry resides. The original IP destination address and source address are retained in the packet. The TTL is decremented and the IP checksum is recalculated. The applications for Policy-Based Routing are quite diverse, since the functionality can be used to set policies on how flows identified by any Layer 2 to Layer 7 field (bounded by the switch's ACL syntax) are forwarded. Deployment scenarios include: • Forwarding flows for certain applications, for example, all HTTP traffic to designated server(s). • Redirecting flows from certain source IP addresses for security and other applications. Policy-Based Routing is implemented using ACLs, so it inherits the capabilities and limitations of ACL. All the matching conditions used for ACLs can be used for Policy-Based Routing. The destination IP address must be an IPv4 unicast address. When a switch finds a matching ACL rule, it forwards the packet to the redirect IP address as specified in the rule without modifying the packet (except as noted above). The traffic flow is redirected only after applying the ACL to the port and redirected only when the redirect IP address's adjacency is resolved. When the IP ARP table does not have the information to reach the redirect IP address, the packet is routed based on the Layer 3 routing table. When the switch does not know how to reach the redirect IP address in the rule, the rule is installed with a warning, but traffic is not redirected until the address is resolved in the IP ARP table. After the address is resolved, the traffic is redirected. 338 | Chapter 13. ACLs