Network:
InterfaceAddresses/WAN2_net
DefaultGateway:
wan_gw
Broadcast:
203.0.113.255
PrivateIP:
<empty>
NOCHB:
<empty>
MTU:
1500
Metric:
100
DHCPEnabled:
No
EthernetDevice:
0:WAN2
1:<empty>
AutoSwitchRoute:
No
AutoInterfaceNetworkRoute:
Yes
AutoDefaultGatewayRoute:
Yes
ReceiveMulticastTraffic:
Auto
MemberOfRoutingTable:
All
Comments:
<empty>
Setting the default gateway on the interface has the additional effect that cOS Core
automatically creates a route in the default
main
routing table that has the network
all-nets
routed on the interface. This means that we do not need to explicitly create this route.
Even though an
all-nets
route is automatically added, no traffic can flow without the existence of
an
IP Policy
which explicitly allows traffic to flow. Let us assume we want to allow web browsing
from the protected network
LAN2_net
which is connected to the interface
LAN2
.
Note that with the NetWall 100 Series, the main IP rule set will already contain a number of
predefined entries that will allow clients on the LAN1 interface to access the Internet via the
WAN1 or
WAN2
interfaces. This is discussed in detail in
Section 4.1, “The NetWall 100 Series Default
.
This section will discuss how IP rule set entries could be manually created to allow Internet
access for clients on
LAN2
via interface
WAN2
.
The following command will add an IP policy called
lan_to_wan
to allow HTTP and HTTPS traffic
through to the public Internet:
Device:/> add IPPolicy Name=lan_to_wan
SourceInterface=LAN2
SourceNetwork=InterfaceAddresses/LAN2_net
DestinationInterface=WAN2
DestinationNetwork=all-nets
Service=http-all
Action=Allow
IP policies have a default value of
Auto
for the type of source translation. This means that if the
source is a private IPv4 address and the destination is a public address, NAT translation will be
performed automatically using the IP address of the outgoing interface as the new source
address. Therefore the above IP policy will work both for connection to another private IP
address or to public addresses on the Internet.
Instead of relying on the
Auto
option, NAT translation can be specified explicitly. For this, the
previous IP policy definition with explicit NAT translation becomes the following:
Device:/> add IPPolicy Name=lan_to_wan
SourceInterface=LAN2
SourceNetwork=InterfaceAddresses/LAN2_net
DestinationInterface=WAN2
DestinationNetwork=all-nets
Service=http-all
Action=Allow
SourceAddressTranslation=NAT
NATSourceAddressAction=OutgoingInterfaceIP
Specifying
NATSourceAddressAction=OutgoingInterfaceIP
is not necessary as this is the default
value but it is included here for clarity.
Chapter 4: cOS Core Configuration
61
Содержание NetWall 100 Series
Страница 1: ...Clavister NetWall 100 Series Getting Started Guide...
Страница 16: ...Chapter 1 NetWall 100 Series Overview 16...
Страница 31: ...Chapter 3 Installation 31...
Страница 72: ...Chapter 4 cOS Core Configuration 72...
