POLICY-BASED ROUTING

na-ot-pbr – Apr, 2009

SUMMARY ●

What is routing

●

Routing mechanisms

●

What is PBR

●

● NETASQ

Use cases: ● Without proxy ● With transparent proxy Tricks and known limitations 2

WHAT IS ROUTING • Used when the destination is not directly connected to the firewall • The goal is to choose the next hop • IP is stateless so the routing subsystem is stateless, too • IP allow asymetric routing • ASQ does not support asymetric routing • If asymetric routing can't be avoided, use an ASQ bypass

NETASQ

3

ROUTING MECHANISMS • Available mechanisms and their priority: 1.Static routing 2.Policy-based routing 3.Source routing

• Each mechanism is tested in turn (like the filter) • The first match is the one that is used • In case of no match the default route is used • Default route include the load-balancing and gateway monitoring subsystems NETASQ

4

ROUTING MECHANISMS / STATIC ROUTING • Based on the destination of the packet • Configured via the section StaticRoutes of ~/ConfigFiles/route • Syntax is destination,ifname->gateway • destination is the destination of the packet, i.e., a network or host object • ifname is the outgoing interface of the routed packet • gateway is the next hop, i.e., a host object

NETASQ

5

ROUTING MECHANISMS / SOURCE ROUTING • Based on the incoming interface of the packet • Configured via the interface's section of ~/ConfigFiles/network • Syntax is Gateway=gateway where gateway is the IP (not an host object) of the next hop • Bounce is not supported and may have side effects, i.e., the gateway must not be in the same network as the interface itself • Customers often mix up with the default gateway

NETASQ

6

WHAT IS POLICY-BASED ROUTING • It's choosing the next hop according to the filter • Having a default route is mandatory • Configured via the filter, i.e., ~/ConfigFiles/Filter/0[1-9] • Syntax is pass route gateway, where gateway is the next hop (a host object) • Static routing have the priority over PBR • Works for incoming connections, too

NETASQ

7

USE CASES / WITHOUT PROXY

pass route GreenGW from Network_in to any port http pass route RedGW from Network_in to any port imap pass route RedGW from Network_dmz to any port smtp

NETASQ

8

USE CASES / WITH TRANSPARENT PROXY 1/2

The default route is the blue route Proxy connections are handled as follow: –the original connection is redirected to the loopback –and the proxy establish an outgoing connection to the original destination.

NETASQ

9

USE CASES / WITH TRANSPARENT PROXY 2/2

•The red connection is filtered by the fwdefault implicit ruleset (see ~/ConfigFiles/Filter/filter) •To avoid matching this ruleset, use BindAddr, e.g., BindAddr=X.X.X.X where X.X.X.X is the IP of Firewall_Green •And create an explicit rule to do PBR as follow: pass route RedGW from Firewall_Green to any

•More on BindAddr in the KB NETASQ

10

TRICKS AND KNOWN LIMITATIONS 1/2

IPsec VPN: –Static routes can still be used for gateway-togateway configurations (green and blue) –PBR can be used for the anonymous configuration; need to rewrite the fwdefault ruleset to route ESP, 500/udp and 4500/udp traffic NETASQ

11

TRICKS AND KNOWN LIMITATIONS 2/2

Incoming traffic on a load-balanced link: -the rule that allow the incoming traffic must use PBR -the gateway will be used to route the returning packets NETASQ

12

EOF

THANK YOU FOR YOUR ATTENTION

NETASQ

13