Kerio Tech Firewall6, Administrator'S Manual

Page: 93 / 404

7.5 Policy routing
93
7.5 Policy routing
If the LAN is connected to the Internet by multiple links with load balancing (see chapter 6.4 ),
it may be needed that one link is reserved for a certain traffic, leaving the rest of the load for
the other links. Such a measure is useful if it is necessary to keep important traffic swinging
(email traffic, the informational system, etc.), i.e. not slowed down by secondary or even
marginal traffic (web browsing, online radio channels, etc.). To meet this crucial requirement
of an enterprise data traffic, it is necessary to consider and employ, besides the destination IP
address, additional information when routing packets from the LAN to the Internet, such as
source IP address, protocol, etc. This approach is called policy routing .
In WinRoute , policy routing can be defined by conditions in traffic rules for Internet access
with IP address translation (NAT). This approach brings wide range of options helping to meet
all requirements for routing and network load balancing.
Note: Policy routing traffic rules are of higher priority than routes defined in the routing table
(see chapter 18.1 ).
Example: A link reserved for email traffic
Let us suppose that the firewall is connected to the Internet by two links with load balancing
with speed values of 4 Mbit/s and 8 Mbit/s . One of the links is connected to the provider where
the mailserver is also hosted. Therefore, it is desirable that all email traffic ( SMTP , IMAP , POP3
protocols and their secured versions) is routed through this link.
Define the following traffic rules to meet these requirements:
• First rule defines that NAT is applied to email services and the Internet 4 Mbit interface
is used.
• The other rule is a general NAT rule with automatic interface selection (see chap-
ter 7.4 ).
Figure 7.30 Policy routing — a link reserved for email traffic