Configuring WAN optimization
WAN optimization and web caching
FortiGate Version 4.0 Administration Guide
606
01-400-89802-20090424
How list order affects rule matching
Similar to firewall policies, you add WAN optimization rules to the WAN optimization rule
list. The FortiGate unit uses the first matching technique to select the WAN optimization
rule to apply to a communication session.
When WAN optimization rules have been added, each time the FortiGate firewall accepts
a communication session, it then searches the WAN optimization rule list for a matching
rule. The search begins at the top of the rule list and progresses in order towards the
bottom. Each rule in the rule list is compared with the communication session until a
match is found. When the FortiGate unit finds the first matching rule, it applies the
matching rule’s specified WAN optimization features to the session, and disregards
subsequent rules. Matching rules are determined by comparing the rule and the session
source and destination addresses and destination port.
If no WAN optimization rule matches, the session is processed according to the firewall
policy that originally accepted the session.
As a general rule, you should order the WAN optimization rule list from most specific to
most general because of the order in which rules are evaluated for a match, and because
only the
first
matching rule is applied to a session. Subsequent possible matches are not
considered or applied. Ordering rules from most specific to most general prevents rules
that match a wide range of traffic from superseding and effectively masking rules that
match exceptions.
Create New
Add a new WAN optimization rule. New rules are added to the bottom of the list.
Status
Select to enable a rule or deselect to disable a rule. A disabled rule is out of
service.
ID
The rule identifier. Rules are numbered in the order they are added to the rule
list.
Source
The source address or address range that the rule matches.
Destination
The destination address or address range that the rule matches.
Port
The destination port number or port number range that the rule matches.
Method
Indicates whether you have selected byte caching in the WAN optimization rule.
Auto-Detect
Indicates whether the rule is an active (client) rule, a passive (server) rule or if
auto-detect is off. If auto-detect is off the rule can be a peer to peer rule or a web
cache only rule.
Protocol
The protocol optimization WAN optimization technique applied by the rule. See
“Protocol optimization” on page 623
Peer
For a peer to peer rule, the name of the peer WAN optimizer at the other end of
the link.
Mode
Indicates whether the rule applies full optimization or web cache only.
SSL
Indicates whether the rule is configured for SSL offloading.
Secure Tunnel
Indicates whether the rule is configured to used a WAN optimization tunnel.
Delete icon
Delete a rule from the list.
Edit icon
Edit a rule.
Insert WAN
Optimization
Rule Before icon
Add a new rule above the corresponding rule (the New rule screen appears).
Move To icon
Move the corresponding rule before or after another rule in the list. See
order affects rule matching” on page 606
and
Summary of Contents for Gate 60D
Page 705: ...www fortinet com...
Page 706: ...www fortinet com...
