Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 4: Understanding Policy Configuration
IP Filter rule basics
128
Figure 54: “Source port”
NAT IP Filter rule
implementation
internal
A network
172.27.18.9
Requirements
Sidewinder G2
Possible connections from workstation
A to application B using “source port
NAT IP Filter rule
Internal IP
172.27.18.9:50
172.27.18.9:50
172.27.18.9:50
172.27.18.9:50
IP aliases
11.80.1.4
11.80.1.5
11.80.1.6
11.80.1.7
11.80.1.1
Please note the following requirements when using NAT to specify the source
port of an IP Filter connection.
• This configuration only applies to uni-directional (source -> destination) IP
Filter rules with stateful inspection enabled.
• Use Source Port when specifying the source port in an IP Filter connection.
See “Creating IP Filter rules” on page 228 for more information.
Sharing IP Filter sessions in an HA cluster
pool of available
IP addresses
app. B
192.1.1.1
listening on port 50
Source IP Source Port Dest IP Dest Port
11.80.1.4 50 192.1.1.1 50
11.80.1.5 50 192.1.1.1 50
11.80.1.6 50 192.1.1.1 50
11.80.1.7 50 192.1.1.1 50
When IP Filter session sharing is configured for an HA cluster, the processing
(often primary) Sidewinder G2 sends out multicast messages to notify the other
nodes (such as the secondary or standby) Sidewinder G2 of IP Filter session
activity (such as a new session, closed session, or change in session state).
Each time a Sidewinder G2 receives a message, it updates its local session
table accordingly. All sessions received from the primary Sidewinder G2 will
have a status of shared on the secondary/standby Sidewinder G2.
When HA causes a secondary/standby Sidewinder G2 to take over as the
acting primary, the shared sessions on the acting primary become available.
When a packet is received for a session, it will be validated against the rules of
the processing Sidewinder G2. The processing Sidewinder G2 will then begin
sending multicast state-change messages.