Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 127 / 861

127 Establishing your network
Defining security gateway routing
Open Shortest Path First (OSPF) Version 2
Defined in RFC 2328, OSPF Version 2 is a link state routing protocol. Unlike RIP-2, which measures the
number of hops between networks, each router in an OSPF environment actively tests the status of the
link to each of its neighbors, and then sends this information to each neighbor. Each router then uses
the reported link state information to build a routing table. Unlike many other routing protocols, OSPF
uses IP (protocol 89) directly.
OSPF is considered to be superior to RIP-2 in many respects. Some of the major advantages in using
OSPF over RIP-2 include:
■
OSPF networks almost always converge (stabilize) faster than RIP-2 networks in the event of a
change to the network topology.
■
OSPF can calculate a separate set of routes for each IP type-of-service, which means for any
destination, there can be multiple routing tables entries, one for each entry.
■
You can base the cost for each interface on various parameters, including throughput, round-trip
time, or reliability. A separate cost can be assigned for each IP service.
■
Because there is no dependency on the number of hops, as is the case with RIP-2, network paths
are not limited to 15 hops.
■
When several equal cost routes to a destination exist, OSPF distributes traffic equally among the
routes (load balancing).
See “Configuring OSPF support” on page 130.
How the security gateway routes traffic
The security gateway uses a three-step process to determine where to send the packets it receives:
■
The security gateway searches its internal routing table for an entry that matches the packet’s
complete destination IP address. If found, the packet is sent directly to that IP address.
■
The security gateway next searches its internal routing table for any address that matches the
packet’s destination network address. If found, the packet is sent to the router that handles traffic
for that network.
■
If the packet has not been routed by this point, the security gateway once again searches its
internal routing table for an entry marked as default. The default route is where any packet, for
which there is no appropriate routing information in the routing table, is sent.
To properly route packets, the security gateway relies on the information stored in the security
gateway’s routing table. Information is added to or updated in the routing table when you add or
change network interfaces, the default gateway, and any static or dynamic routes.
Defined network interfaces
Network interfaces are normally configured when the System Setup Wizard runs the first time that
you connect to the security gateway. However, you can run the System Setup Wizard at any time to
change existing network information, or enable a new interface. Once an interface is enabled, a host
record is added to the routing table.
See “Adding a network interface” on page 104.
The default gateway
The default gateway is the address that the security gateway uses to route packets when there are no
other matching entries found in the routing table. Each interface can have a default gateway assigned;
however, you should only assign a default gateway to the outside interface (the one that connects you
to your ISP). Internal or service network interfaces should leave the default gateway blank. Having
more than one default gateway manually configured is not supported.