Packet Processing in the IP Context
39
CopperLink CL2300 User Manual
5
• IP Context Overview
Classifier
The classifier is the first profile that inspects an incoming packet. The classifier assigns a traffic class to each
packet. You can think of the traffic-class as if every packet in the router has a tag attached to it, on which the
classification can be noted. The traffic-class tags exist only inside the router, but layer 2 priority bits (802.1pq
class-of-service) and IP header type-of-service bits (TOS field) can be used to mark a specific packet type for
the other network devices. By default the traffic-class tag is
default
.
A powerful packet-matching filter in the classifier profile lets you inspect any combination of IP, UDP, TCP or
ICMP header fields and assign a traffic-class to the matching packet flow. For example, you may configure to
tag all UDP packets to a destination port between 5000 and 8000, and shorter than 500 bytes with the traffic-
class
VOICE.
The traffic-class tag can later be used in other IP service profiles, e.g., to filter packets in the ACL
or to do policy routing by selecting a routing-table based on the traffic-class.
Network Address Port Translation (NAPT)
After classification is done, the packet is handed over to the NAPT profile-if one is used on the current inter-
face. Network Address Port Translation (NAPT), which is an extension to NAT, uses TCP/UDP ports in addi-
tion to network addresses (IP addresses) to map multiple private network addresses to a single outside address.
Thus the NAPT profile may change the destination address and port of an incoming packet.
Routing-table Selection
You may configure policy routing by selecting a different routing table based on some header fields of the
incoming packet. You may also use the traffic-class (tagged before in the Classifier) to make a routing-table
decision. For example, you may direct all packets tagged with the VOICE traffic-class to a separate routing
table while processing the other traffic with the default routing table.
Note
The routing-table selection for an incoming packet is performed after
NAPT, i.e., you will see the translated (private) addresses and ports
Access Control Lists (ACL)
An access control list is a sequential collection of permit and deny conditions that apply to packets on a certain
interface. You can use the same packet-matching mechanism as in the classifier and the routing-table selection
to decide whether the specified packet flow is permitted to enter the router or is rejected.
The ACL filter is passed after the routing decision has been made. This allows you to apply an ACL to an
input-output interface pair. For example, you may use a specific profile for all packets entering the router via
the LAN interface and leaving it over the DMZ interface.
Routing
Once a packet traversed all ingress packet filters (controlled by the attached profiles), the router decides
whether the packet is destined to an application of the gateway itself or shall be routed to a remote host. For
this purpose it performs a best-prefix match on the destination IP address in the routing-table, which was pre-
viously selected. If no routing-table has been selected explicitly, the DEFAULT table is consulted.
If the packet is to be sent to a remote host, it traverses the egress filters of the IP interface (depicted in
), an egress ACL, another possibility to classify the packet, NAPT translations and finally, a service-
policy profile, which can be used to map an internal traffic-class to IP TOS field values.