Chapter 20: Forwarding - Tavve zoneranger User Manual

Chapter 20: Forwarding

ZoneRanger can be configured to listen for UDP traffic on specified ports, and forward that traffic
through a Ranger Gateway to a specified destination host and port that is reachable from the Ranger
Gateway. ZoneRanger can forward the following types of traffic:
•
Trap
•
Syslog
•
sFlow
•
NetFlow
•
Generic UDP
Unless the ZoneRanger model is SPX, the traps, datagrams, and messages that ZoneRanger forwards
must originate from managed nodes. In the case of the SPX model, all information is forwarded
regardless of originating address. Forwarding rules are used to specify the type, source, and destination
of UDP information on the ZoneRanger to which to forward to a Ranger Gateway and ultimately a
management application.
Figure 20-1. ZoneRanger Forwarding
When UDP information is forwarded from the ZoneRanger to a Ranger Gateway to its ultimate
destination, the source address of the UDP information when it is received by the management
application is the address of the Ranger Gateway since it sent the UDP data. However, The Ranger
Gateway can be configured for particular protocols to "spoof" the address of the information to be that
of the original sending device instead of the address of the Ranger Gateway. Depending on the
requirements of the management application, spoofing may need to be configured for particular
protocols.
Forwarding Rules
Forwarding rules define the source and destination information of the UDP data to be forwarded.
Forwarding rules are configured on the ZoneRanger Configuration > Forwarding page. Each
forwarding rule is associated with a Ranger Gateway. Any number of forwarding rules may be
associated with a Ranger Gateway.
Forwarding rules are defined by the following criteria:
•
Type of UDP traffic
•
Source address of the UDP traffic
•
Local port ZoneRanger listens for UDP traffic
•
Destination host to which Ranger Gateway will forward UDP traffic
ZoneRanger 5.5 User's Guide 61