Radware Alteon, Инструкция по применению

Страница: 359 / 842

Alteon Application Switch Operating System Application Guide
Filtering and Traffic Manipulation
Document ID: RDWR-ALOS-V2900_AG1302
359
Default Filter
Before filtering can be enabled on any given port, a default filter should be configured. This filter
handles any traffic not covered by any other filter. All the criteria in the default filter must be set to
the fullest range possible (any). For example:
Example Default Filter
In this example, the default filter is defined as Filter 2048 to give it the lowest order of precedence.
All matching criteria in Filter 2048 are set to any. If the traffic does not match the filtering criteria of
any other filter and no action is triggered, Filter 2048 processes it, denying and logging unwanted
traffic.
Default filters are recommended, but not required, when configuring filters for IP traffic control and
redirection. Using default filters can increase session performance but takes some of the session
binding resources. If you experience an unacceptable number of binding failures, as shown in the
Server Load Balancing Maintenance statistics (
/stats/slb/maint
), you may want to remove
some of the default filters.
Optimizing Filter Performance
Filter efficiency can be increased by placing filters that are used most often near the beginning of
the filtering list.
Note: Radware recommends numbering filters in small increments (5, 10, 15, 20, and so on) to
make it easier to insert filters into the list at a later time. However, as the number of filters
increases, you can improve performance by minimizing the increment between filters. For example,
filters numbered 2, 4, 6, and 8 are more efficient than filters numbered 20, 40, 60, and 80. Peak
processing efficiency is achieved when filters are numbered sequentially beginning with 1.
>> # /cfg/slb/filt 2048
(Select the default filter)
>> Filter 2048# sip any
(From any source IP addresses)
>> Filter 2048# dip any
(To any destination IP addresses)
>> Filter 2048# proto any
(For any protocols)
>> Filter 2048# action deny
(Deny matching traffic)
>> Filter 2048# name deny unwanted traffic
(Provide a descriptive name for the filter)
>> Filter 2048# ena
(Enable the default filter)
>> Filter 2048# adv
(Select the advanced menu)
>> Filter 2048 Advanced# log enable
(Log matching traffic to syslog)