When a new connection is opened with
dmz_net
as the destination, NetDefendOS first performs
a lookup in the
main
table. The appropriate
Goto
rule triggers and the rule search continues in
the rule set called
dmz_ip_rules
. The diagram below illustrates the example.
This example uses the destination network as the method of dividing up the rules but another
factor, such as an interface or service, could have been used instead.
This approach creates a multi-level tree structure, a technique which is used in many situations
for efficient searching of large amounts of data. The optimum size of any rule set can only be
determined on a case by case basis. However, a rule of thumb that can be applied is to not allow
any rule set exceed a thousand entries. Above that number, using
Goto
rules should be
considered to help in speeding up rule set processing.
Example 3.32. Adding a Goto Rule
In this example, a
Goto
rule is added to the end of the IP rule set
main
so that all traffic going to
the network
dmz_net
uses the rule set
dmz rules
. It is assumed that the IP rule set
dmz_rules
has
already been created.
Command-Line Interface
gw-world:/> add GotoRule SourceInterface=any
SourceNetwork=all-nets
DestinationInterface=any
DestinationNetwork=dmz_net
Service=all_services
RuleSet=dmz_rules
Name=goto_dmz
Web Interface
Chapter 3: Fundamentals
238
Summary of Contents for NetDefendOS
Page 30: ...Figure 1 3 Packet Flow Schematic Part III Chapter 1 NetDefendOS Overview 30 ...
Page 32: ...Chapter 1 NetDefendOS Overview 32 ...
Page 144: ...Chapter 2 Management and Maintenance 144 ...
Page 284: ...Chapter 3 Fundamentals 284 ...
Page 392: ...Chapter 4 Routing 392 ...
Page 419: ... Host 2001 DB8 1 MAC 00 90 12 13 14 15 5 Click OK Chapter 5 DHCP Services 419 ...
Page 420: ...Chapter 5 DHCP Services 420 ...
Page 573: ...Chapter 6 Security Mechanisms 573 ...
Page 607: ...Chapter 7 Address Translation 607 ...
Page 666: ...Chapter 8 User Authentication 666 ...
Page 775: ...Chapter 9 VPN 775 ...
Page 819: ...Chapter 10 Traffic Management 819 ...
Page 842: ...Chapter 11 High Availability 842 ...
Page 866: ...Default Enabled Chapter 13 Advanced Settings 866 ...
Page 879: ...Chapter 13 Advanced Settings 879 ...