Routing configuration

Deployment and Installation Center | Web and Email Security Solutions | Version 7.8.x

Applies to:

In this topic

Web Security, Web Security Gateway, and Web Security Gateway Anywhere, v7.8.x

Email Security Gateway and Email Security Gateway Anywhere, v7.8.x

V10000 G2, V10000 G3, and V5000 G2, v7.8.x

Configuring static routes

Configuring module routes

Use the Configuration > Routing page to specify:

Static routes from subnets and client computers through any active appliance interface, except N. If IPv6 is enabled, static IPv6 routes can also be added and imported.

Module routes from appliance modules through appliance interface C to subnets. IPv6 module routes are not supported.

Configuring static routes

Static routes can be specified for any active interface on the appliance, except N, which is dedicated to Network Agent and cannot be routed.

The same route cannot be added for 2 different interfaces on the same module. If this operation is attempted, the appliance displays an error.

Static routes that are defined for an interface that is later made inactive remain in the routing table, and are displayed in gray to indicate that the routes are inactive.

Static routes that become invalid because the IP address of the interface changes are disabled and displayed in red.

Static routes can be added and deleted, but not modified. To modify a route, delete it and add a new route specifying the new values.

When a static route is added, imported, or deleted, the services associated with the module that manage the specified interface must be restarted. For example, if static routes are added to interface P1, when the additions are complete, all Content Gateway services must be restarted.

The static route table has a maximum limit of 5000 entries.

Adding static routes

Static routes can be added one at a time, or many at a time using an import file.

When a static route is added, data entered in each field is validated by the appliance, and an error message is displayed if there is an inconsistency in the route.

To add static routes:

Go to the Configuration > Routing page, select the IPv4 or IPv6 tab, and click Add/Import under Static Routes.

To manually add a single route, select the Add individual route radio button, enter values for all fields, and then click Add Route.


Destination Network	Required. Specify the subnet IP address for which traffic will be routed.
Subnet Mask (IPv4) or Subnet prefix length (IPv6)	Required. The subnet mask or prefix for the network where the clients reside (such as 255.255.0.0, or 64)
Gateway	Required. IP address providing access from the proxy subnet to the client subnet. This address must be on the same subnet as the appliance.
Interface	Required. The appliance interface to be used for the static route. Only active interfaces are offered in the drop down list.

To add multiple routes using an import list file:

Prepare the import file. See Import file specifications, below.

Select the Import route file radio button.

Specify the full path and file name, or Browse to locate the file. Click Import Route to import the routes specified in the file.

The appliance reads the file, validates each route, and reports errors for lines that are invalid.

Duplicate route entries are ignored; duplicate entries are not created.

If the number of routes in the file, combined with the number of existing routes exceeds the 5000 route table limit, the import fails. No routes are added and an error message displays.

Import file specifications:

The file must be a plain text file. (Most routers export route tables to a plain text file.)

The file can contain comment lines. Comment lines begin with "#".

A line that defines a route must include the following 4 fields in the order shown. Each field must be separated by a space.

For IPv4:

destination netmask default-gateway interface

Destination is a subnet address or host IP address.

Netmask determines the proper value of destination.

Default-gateway is the next hop.

Interface is the appliance interface through which traffic is routed. The specified interface must be enabled. If it is disabled, the appliance reports an error and does not add the route.

For IPv6:

destination prefix-length default-gateway interface

Destination is a subnet address or host IP address.

Prefix-length determines the proper value of destination.

Default-gateway is the next hop.

Interface is the appliance interface through which traffic is routed. The specified interface must be enabled. If it is disabled, the appliance reports an error and does not add the route.

Exporting the route table

To export the route table to a text file, click Export Table. Use the Browse dialog to specify a location and name for the file.

All routes in the table, whether enabled or disabled, are exported.

The file is formatted as described above for import files.

Configuring module routes

In some deployments it is necessary or desirable to route some Web Security or Email Security traffic through the appliance C interface (typically web and email traffic is routed through separate, dedicated interfaces [P1/P2, E1/E2] and C is reserved for management traffic). However, some sites might want to route authentication (or other) traffic through the C interface. This is accomplished by defining module routes on the Configuration > Routing page.

The module route table has a maximum limit of 5000 entries.

Adding a module route

In the Module Route section of the Configuration > Routing page, click Add.

Specify a value for each field and click Add Route.


Module	Required. Select a module from the drop down list. The list displays only modules installed on the appliance. The Network Agent module may be installed, but will not appear in the list.
Destination subnet	Required. Specify the subnet IP address for which traffic will be routed.
Subnet mask	Required. The subnet mask for the destination subnet.


	Note It is the responsibility of the administrator to verify that the endpoint is available on the subnet.