Foundry Networks Switch and Router Installation And Configuration Manual page 1024

Foundry Switch and Router Installation and Configuration Guide
Syntax
Use the following CLI commands or Web management interface panels to configure router acceleration policies.
Foundry Product
FastIron Backbone,
TurboIron Backbone
NOTE: You must enable router acceleration before the feature or the policies will take effect. To enable IP
router acceleration, enter the ip-route-accelerating or ipx-route-accelerating command at the global CONFIG
level of the CLI.
Layer 4 Policies
Layer 4 policies are rules that control transmission and receipt of packets based on Layer 4 transport information.
You can configure the following types of Layer 4 policies:
• TCP/UDP access policies (same as TCP/UDP filters)
• Cache server redirection policies (used by the ServerIron's Transparent Cache Switching feature)
TCP/UDP Access Policies
TCP/UDP access policies are IP filters that contain Layer 4 information. Layer 4 policies enable you to forward or
drop packets for individual Layer 4 applications, giving you finer access control. You do not need to completely
block an IP address to deny certain types of traffic from that address. You can selectively allow some types of
traffic while dropping others. For example, you can configure a Layer 4 policy to drop web (HTTP) packets from a
host but allow all other traffic from the host.
You can filter on the following Layer 4 application types:
• ICMP
• IGMP
• IGRP
• OSPF
• TCP
• UDP
For TCP and UDP, you also specify an operator and the port number or well-known name for the port. For
example, if you want to filter on FTP traffic, you configure the filter to match on packets that contain the TCP
application port number for FTP.
You can configure Layer 4 policies on all Foundry devices.
C - 20
Table C.7: Router Acceleration Policies
CLI syntax
TurboIron(config)# ip policy <num> priority high |
normal tcp | udp <tcp/udp-port-num> global | local
TurboIron(config-if-1)# ip policy-group in | out
<policy-list>
TurboIron(config)# ipx forward-filter <filter-num>
permit | deny <source-network-number> | any
<source-node-number> | any
<destination-network-number> | any
TurboIron(config-if-1)# ipx forward-filter-group in |
out <filter-list> <destination-node-number> | any
<destination-socket-number> | any
Web management links
Configure->IP->Access Policy
Configure->IPX->Forward Filter
December 2000