Coyote Point Systems Equalizer GX Series, Руководство администратора

Страница: 134 / 866

Load Balancing & Networking
IP Filter Rules
The current IP Filter rules are displayed as part of the CLI output when using the
show sbr
command. An example is shown below. The example is shortened due to its length.
Note - The example below is a truncated example of the show sbr command display. In addition to the IP Filter
Rules, Default Source Selection Table, the IPv6 Default Selection Table, IPv6 Rules, and IP NAT rules will also be
displayed.
IP Filter Rules:
IPv4 Rules:
1: pass on interface lo0 all hits: 287 bytes: 14900
2: pass on interface wm1 hits: 11394 bytes: 326068
From To
192.168.211.0/24 192.168.211.0/24
192.168.105.0/24 -> 192.168.105.0/24
10.0.0.0/24
0.0.0.0/0
3: pass on interface wm0 hits: 120406 bytes: 7689819
From To
10.0.0.0/24 10.0.0.0/24
0.0.0.0/0 -> 0.0.0.0/0
192.168.211.0/24
192.168.105.0/24
4: block on interface wm1 hits: 0 bytes: 0
From To
192.168.211.0/24 192.168.211.0/24
-> 192.168.105.0/24
10.0.0.0/24
0.0.0.0/0
The example above shows each filter rule, along with the groups of networks that the rule applies
to, and the number of times each rule has been used (and bytes that have been received using
this rule).
Each column of From and To addresses can be viewed as an "or" group. For example, rule #3 can
be read as:
“Allow traffic on interface wm0 which is from either the 10.0.0.0/24 network or the 0.0.0.0/0
network, and is destined for either the 10.0.0.0/24, the 0.0.0.0/0, the 192.168.211.0/24, or the
192.168.105.0/24 network.”
Rules are processed (and must be read) in order, from first to last. This means that as soon as a
packet matches a particular rule it is used and Equalizer either passes or allows that packet,
depending on the rule.
The individual rules are somewhat complicated and will be explained in
"Load Balancing
& Networking"
on page 89
134 Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.