Configuration > X10G security blade routing configuration

X10G security blade routing configuration

Use the Configuration > Routing page to specify:

Static routes from subnets and client computers through any active blade interface, except C.

Module routes from security blade modules through blade interface C to subnets.

Configuring static routes

Static routes can be specified for any active interface on the security blade, except N, which is dedicated to Network Agent and cannot be routed.

The same route cannot be added for 2 different interfaces on the same module. If attempted, the blade displays an error.

Static routes that are defined for an interface that is later made inactive remain in the routing table, and are displayed in gray to indicate that the routes are inactive.

Static routes that become invalid because the IP address of the interface changes are disabled and displayed in red.

Static routes can be added and deleted, but not modified. To modify a route, delete it and add a new route specifying the new values.

The static route table has a maximum limit of 5,000 entries.

Adding static routes

Static routes can be added one at a time, or many at time using an import file.

When a static route is added, data entered in each field is validated by the blade, and an error message is displayed if there is an inconsistency in the route.

To add static routes:

1.	Go to the Configuration > Routing page and click Add/Import under Static Routes.

2.	To manually add a single route, select the Add individual route radio button, enter values for all fields, and then click Add Route.

 

Destination Network	Required. Specify the subnet IP address for which traffic will be routed.
Subnet Mask	Required. The subnet mask for the network where the clients reside (such as 255.255.0.0)
Gateway	Required. Gateway must be on the same subnet as the selected interface.
Interface	Required. The blade interface to be used for the static route. Only active interfaces are offered in the drop-down list.

3.	To add multiple routes using an import list file:

a.	Prepare the import file. See Import file specifications, below.

b.	Select the Import route file radio button.

c.	Specify the full path and file name, or Browse to locate the file. Click Import Route to import the routes specified in the file.

The security blade reads the file, validates each route, and reports errors for lines that are invalid.

Duplicate route entries are ignored; duplicate entries are not created.

If the number of routes in the file, combined with the number of existing routes exceeds the 5,000 route table limit, the import fails. No routes are added and an error message displays.

Import file specifications:

1.	The file must be a plain text file. (Most routers export route tables to a plain text file.)

2.	The file can contain comment lines. Comment lines begin with "#".

3.	A line that defines a route must include the following 4 fields in the order shown. Each field must be separated by a space.

destination netmask default-gateway interface

Destination is a subnet address or host IP address.

Netmask determines the proper value of destination.

Default-gateway is the next hop.

Interface is the security blade interface through which traffic is routed. The specified interface must be enabled. If it is disabled, the blade reports an error and does not add the route.

Deleting static routes

1.	In the Static Routes table, select the routes to be deleted:

To select 1 route, click the box to the left of entry you want to delete.

To select multiple entries, click the box to the left of each entry you want to delete.

To delete all routes, click the box to the left of the label Destination Network.

2.	Click Delete.

Exporting the route table

To export the route table to a text file, click Export Table. Use the Browse dialog to specify a location and name for the file.

All routes in the table, whether enabled or disabled, are exported.

The file is formatted as described above for import files.

Configuring module routes

In some deployments, it is necessary or desirable to route some Web traffic through the security blade C interface (typically Web traffic is routed through separate, dedicated interfaces (A1.P1 or A1.P2), and C is reserved for management traffic). However, some sites might want to route authentication (or other) traffic through the C interface. This is accomplished by defining module routes on the Configuration > Routing page if this is supported by your subscription.

The module route table has a maximum limit of 5,000 entries.

Adding a module route

1.	In the Module Route section of the Configuration > Routing page, click Add.

2.	Specify a value for each field and click Add Route.

Module	Required. Select a module from the drop down list. The list displays only modules installed on the security blade. The Network Agent module may be installed, but will not appear in the list.
Destination subnet	Required. Specify the subnet IP address for which traffic will be routed.
Subnet mask	Required. The subnet mask for the destination subnet.

 

Note  It is the responsibility of the administrator to verify that the endpoint is available on the subnet.

Deleting a module route

1.	In the Module Routes section, select the routes to be deleted.

To select 1 route, click the box to the left of entry you want to delete.

To select multiple entries, click the box to the left of each entry you want to delete.

To delete all routes, click the box to the left of the label Module.

2.	Click Delete.

Configuration > X10G security blade routing configuration