Radware DefensePro 6.02, Руководство пользователя

Страница: 221 / 339

Document ID: RDWR-DP-V0602_UG1201
221
Chapter 7 – Managing Classes
Classes define groups of elements of the same type of entity.
You can configure classes based on the following:
• Networks—to classify traffic in a network-protection rule or a bandwidth management rule.
• Application ports—to define or modify applications based on Layer 4 destination ports.
• Physical device ports—to classify traffic in a network-protection rule or a bandwidth
management rule.
• VLAN tags—to classify traffic in a network-protection rule or a bandwidth management rule.
• MAC addresses—to classify traffic whose source or destination is a transparent network
device.
• MPLS RDs—to classify traffic in a network-protection rule.
After you create or modify a class, the configuration is saved in the APSolute Vision database. You
must activate the configuration to download it to the device. You can also view the current class
configurations on your device. After creation, you cannot modify the name of a class, or the
configuration of application, MAC, or physical port classes.
This chapter contains the following topics:
• Configuring Network Classes, page 221
• Configuring Application Classes, page 223
• Configuring Physical Port Classes, page 224
• Configuring VLAN Tag Classes, page 224
• Configuring MAC Address Classes, page 225
• Viewing Active Class Configurations, page 226
• Configuring MPLS RD Groups, page 227
Configuring Network Classes
A network class is identified by a name and defined by a network address and mask, or by a range
of IP addresses (from-to). For example, network net1 can be 10.0.0.0/255.0.0.0 and network net2
can be from 10.1.1.1 to 10.1.1.7; alternatively, network net1 can be 1234::0/32 and network net2
can be from 1234::0 to 1234:FFFF:FFFF:FFFF. The Network list allows either configuration.
Using classes allows you to define a network comprised of multiple subnets and/or IP ranges, all
identified with the same class name. For example, network net1 can be 10.0.0.0/255.255.255.0 and
10.1.1.1 to 10.1.1.7.
You can use network classes in the following:
• Black lists
• White lists
• Network-protection policies/rules to match source or destination traffic
Note: APSolute Vision uses the term rule (or rules), whereas DefensePro may use the term
policy (or policies).
• Bandwidth management rules