Exinda EXNV-10063, Administration Manual

Page: 325 / 623

Exinda Network Orchestrator 3 Using | 325
The only allowable applications are HTTP, HTTP-ALT, and HTTPS. It is recommended to add three filter rules - one for
each of these applications.
For each of the filter rules specify the Filter traffic Source to be the destination network object that was created as part of
the adaptive response limit object and specify the
Filter
traffic
Direction
to be
Both
.
To create a policy that blocks remaining traffic for the shoppers who are over quota:
1. Select Discard as the policy action.
2.
If you want to block all traffic, then do not check the
Discard only the first packet of the connection
checkbox.
3. Type the Filter Rules specifying the shoppers over quota network object.
Specify the
Filter
traffic
Source
to be the destination network object that was created as part of the adaptive response
limit object and specify the Filter traffic Direction to be Both .
3.5.4 Creating Applications from DSCP-marked traffic (like Riverbed accelerated traffic)
Some times you might find that the Exinda Appliance is located between two other types of network appliances that
modify the traffic in a way that obscures the visibility of the Exinda appliance into the traffic. An example of this would
be having the Exinda Appliance located between two Riverbed appliances doing acceleration. The Riverbed appliances
will send all of the accelerated traffic over port 7800. The Exinda Appliance will then see all accelerated traffic as a single
application even if there are multiple types of application traffic within that single Riverbed tunnel.
In this situation, DSCP marking of traffic can restore the visibility of different traffic types to the Exinda Appliance. Often
these other network appliances will have the ability to apply DSCP marks to traffic based on the type of application traffic
they are accelerating. For instance, these other appliances may be configured to apply DSCP mark 2 to all HTTP traffic
and DSCP mark 3 to all SMB traffic. Then, on the Exinda appliance, you can create applications based on the DSCP marks.
Consider a Riverbed appliance and Exinda appliance in the same environment. By default the Exinda Appliance will
report the accelerated traffic streams from the Riverbed appliance as a single traffic type. If you configure the Riverbed
appliances to add DSCP markings based on specific traffic types, then on the Exinda appliance create applications based
on the DSCP markings and the Riverbed tunnel port number. Each of these applications appears on the Exinda
Appliance like other built in applications. That is, these new Riverbed accelerated applications appear on the
applications monitor and on the real-time screen. They can also be added to application groups and can have policy
applied to them.
VERSION INFO
The ability to create applications based on DSCP-marked traffic is available in 7.0.1 and above (in the 7.0 firmware
product line) and in 6.4.5 and above (in the 6.4 firmware product line).
To create applications based on DSCP marked applications in Riverbed-accelerated traffic:
1.
On your Riverbed appliance, add DSCP markings for each traffic type that you are interested in.
See your Riverbed documentation to learn how to do this.
2. On your Exinda appliance, add an application for each DSCP-marked application type.
On the
Add new Application
form, type the DSCP mark number in the
DSCP
field and optionally fill in the
Ports/Protocols field by selecting TCP Port Range and type 7800.
For instance, you could create a Riverbed SMB application and a Riverbed HTTP application.
Note that application names must be unique. SMB and HTTP are already named applications on the application, so you
will have to name these new applications differently.
For more information, refer to Predefined Applications and Supported L7 Signatures (page 573).