쫑콩아빠의 지금 이 순간...

Example 17 is an inline bypass solution on GigaVUE-HC2 for an inline tool group with four tools. It is similar to Example 16: Asymmetrical Hashing in Inline Tool Group, but has four rule-based inline maps, one to each individual member of the inline tool group. In Example 17, asymmetrical hashing is used, but the hashing could also be symmetrical. The hashing only applies to the traffic sent to the shared collector.

Example 17 is different from Example 5: Inline Tool Group (N+1) Redundancy. In Example 5, all the traffic was sent to the inline tool group as a whole, using a map passall. Hashing distributed the traffic across the group.

With the multiple rule-based maps in Example 17, specific traffic is sent to specific tools in the inline tool group according to the rules. Each of the four inline maps directs traffic from one source IP address to a specific inline tool in the group.

A shared collector is configured from the inline network to the inline tool group. Traffic that does not match any of the map rules is sent to the shared collector and will be distributed according to the hashing value specified for the group.

Step

Description

Command

1. Configure inline network aliases, port type (inline-network), and administratively enable inline network ports.

(config) # port 1/2/x1 alias iN1
(config) # port iN1 type inline-network
(config) # port iN1 params admin enable

(config) # port 1/2/x2 alias iN2
(config) # port iN2 type inline-network
(config) # port iN2 params admin enable

2. Configure inline network.

(config) # inline-network alias inNet pair net-a iN1 and net-b iN2

3. Configure inline tool ports, port type (inline-tool), and administratively enable inline tool ports.

(config) # port 1/2/x15 alias iT1
(config) # port iT1 type inline-tool
(config) # port iT1 params admin enable

(config) # port 1/2/x16 alias iT2
(config) # port iT2 type inline-tool
(config) # port iT2 params admin enable

(config) # port 1/2/x19 alias iT3
(config) # port iT3 type inline-tool
(config) # port iT3 params admin enable

(config) # port 1/2/x20 alias iT4
(config) # port iT4 type inline-tool
(config) # port iT4 params admin enable

(config) # port 1/2/x21 alias iT5
(config) # port iT5 type inline-tool
(config) # port iT5 params admin enable

(config) # port 1/2/x22 alias iT6
(config) # port iT6 type inline-tool
(config) # port iT6 params admin enable

(config) # port 1/2/x23 alias iT7
(config) # port iT7 type inline-tool
(config) # port iT7 params admin enable

(config) # port 1/2/x24 alias iT8
(config) # port iT8 type inline-tool
(config) # port iT8 params admin enable

4. Configure inline tools and enable them.

(config) # inline-tool alias inTool1 pair tool-a iT1 and tool-b iT2
(config) # inline-tool alias inTool2 pair tool-a iT3 and tool-b iT4
(config) # inline-tool alias inTool3 pair tool-a iT5 and tool-b iT6
(config) # inline-tool alias inTool4 pair tool-a iT7 and tool-b iT8

(config) # inline-tool alias inTool1 enable
(config) # inline-tool alias inTool2 enable
(config) # inline-tool alias inTool3 enable
(config) # inline-tool alias inTool4 enable

5. Configure inline tool group and parameters. Enable it and then configure failover action.

(config) # inline-tool-group alias inToolGroup
(config inline-tool-group alias inToolGroup) # tool-list inTool1,inTool2,inTool3,inTool4
(config inline-tool-group alias inToolGroup) # hash a-srcip-b-dstip
(config inline-tool-group alias inToolGroup) # minimum-group-healthy-size 4
(config inline-tool-group alias inToolGroup) # enable
(config inline-tool-group alias inToolGroup) # failover-action network-bypass
(config inline-tool-group alias inToolGroup) # exit
(config) #

6. Configure rule-based map, from inline network to first tool in inline tool group, from the same source, inNet.

(config) # map alias inNet-to-inTool1
(config map alias inNet-to-inTool1) # type inline byRule
(config map alias inNet-to-inTool1) # from inNet
(config map alias inNet-to-inTool1) # to inTool1
(config map alias inNet-to-inTool1) # rule add pass ipsrc 10.10.10.101 /32
(config map alias inNet-to-inTool1) # exit
(config) #

7. Configure rule-based map, from inline network to second tool in inline tool group, from the same source, inNet.

(config) # map alias inNet-to-inTool2
(config map alias inNet-to-inTool2) # type inline byRule
(config map alias inNet-to-inTool2) # from inNet
(config map alias inNet-to-inTool2) # to inTool2
(config map alias inNet-to-inTool2) # rule add pass ipsrc 20.10.20.102 /32
(config map alias inNet-to-inTool2) # exit
(config) #

8. Configure rule-based map, from inline network to third tool in inline tool group, from the same source, inNet.

(config) # map alias inNet-to-inTool3
(config map alias inNet-to-inTool3) # type inline byRule
(config map alias inNet-to-inTool3) # from inNet
(config map alias inNet-to-inTool3) # to inTool3
(config map alias inNet-to-inTool3) # rule add pass ipsrc 31.11.31.103 /32
(config map alias inNet-to-inTool3) # exit
(config) #

9. Configure rule-based map, from inline network to fourth tool in inline tool group, from the same source, inNet.

(config) # map alias inNet-to-inTool4
(config map alias inNet-to-inTool4) # type inline byRule
(config map alias inNet-to-inTool4) # from inNet
(config map alias inNet-to-inTool4) # to inTool4
(config map alias inNet-to-inTool4) # rule add pass ipsrc 41.11.41.104 /32
(config map alias inNet-to-inTool4) # exit
(config) #

10. Add a shared collector for any unmatched data and send it to the inline tool group. Again, the source is the same, inNet.

(config) # map-scollector alias inNet-to-ITG
(config map-scollector alias inNet-to-ITG) # from inNet
(config map-scollector alias inNet-to-ITG) # collector inToolGroup
(config map-scollector alias inNet-to-ITG) # exit
(config) #

11. Configure the path of the traffic to inline tool.

(config) # inline-network alias inNet traffic-path to-inline-tool

12. Display the configuration for this example.

(config) # show inline-tool-group
(config) # show map

Example 16 is an inline bypass solution on GigaVUE-HC2 for an inline tool group with four tools. The inline tool group uses asymmetrical hashing (unlike Example 5: Inline Tool Group (N+1) Redundancy which uses symmetrical hashing). The hashing is based on the source IP address for side A and the destination IP address for side B.

A rule-based map (vlan 200) is configured from the inline network to the inline tool group. Traffic that matches the map rule and has the same source IP on side A and destination IP on side B will be sent to the same inline tool in the inline tool group.

A shared collector is configured from the inline network to bypass. Traffic that does not match the map rule will be sent to the shared collector and bypassed.

Step

Description

Command

1. Configure inline network aliases, port type (inline-network), and administratively enable inline network ports.

(config) # port 1/2/x1 alias iN1
(config) # port iN1 type inline-network
(config) # port iN1 params admin enable

(config) # port 1/2/x2 alias iN2
(config) # port iN2 type inline-network
(config) # port iN2 params admin enable

2. Configure inline network.

(config) # inline-network alias inNet pair net-a iN1 and net-b iN2

3. Configure inline tool ports, port type (inline-tool), and administratively enable inline tool ports.

(config) # port 1/2/x15 alias iT1
(config) # port iT1 type inline-tool
(config) # port iT1 params admin enable

(config) # port 1/2/x16 alias iT2
(config) # port iT2 type inline-tool
(config) # port iT2 params admin enable

(config) # port 1/2/x19 alias iT3
(config) # port iT3 type inline-tool
(config) # port iT3 params admin enable

(config) # port 1/2/x20 alias iT4
(config) # port iT4 type inline-tool
(config) # port iT4 params admin enable

(config) # port 1/2/x21 alias iT5
(config) # port iT5 type inline-tool
(config) # port iT5 params admin enable

(config) # port 1/2/x22 alias iT6
(config) # port iT6 type inline-tool
(config) # port iT6 params admin enable

(config) # port 1/2/x23 alias iT7
(config) # port iT7 type inline-tool
(config) # port iT7 params admin enable

(config) # port 1/2/x24 alias iT8
(config) # port iT8 type inline-tool
(config) # port iT8 params admin enable

4. Configure inline tools and enable them.

(config) # inline-tool alias inTool1 pair tool-a iT1 and tool-b iT2
(config) # inline-tool alias inTool2 pair tool-a iT3 and tool-b iT4
(config) # inline-tool alias inTool3 pair tool-a iT5 and tool-b iT6
(config) # inline-tool alias inTool4 pair tool-a iT7 and tool-b iT8

(config) # inline-tool alias inTool1 enable
(config) # inline-tool alias inTool2 enable
(config) # inline-tool alias inTool3 enable
(config) # inline-tool alias inTool4 enable

5. Configure inline tool group and parameters. Enable it and then configure failover action.

(config) # inline-tool-group alias inToolGroup
(config inline-tool-group alias inToolGroup) # tool-list inTool1,inTool2,inTool3,inTool4
(config inline-tool-group alias inToolGroup) # hash a-srcip-b-dstip
(config inline-tool-group alias inToolGroup) # minimum-group-healthy-size 4
(config inline-tool-group alias inToolGroup) # enable
(config inline-tool-group alias inToolGroup) # failover-action tool-bypass
(config inline-tool-group alias inToolGroup) # exit
(config) #

6. Configure rule-based map, from inline network to inline tool group.

(config) # map alias inNet-to-ITG
(config map alias inNet-to-ITG) # type inline byRule
(config map alias inNet-to-ITG) # from inNet
(config map alias inNet-to-ITG) # to inToolGroup
(config map alias inNet-to-ITG) # rule add pass vlan 200
(config map alias inNet-to-ITG) # exit
(config) #

7. Add a shared collector for any unmatched data and send it to bypass.

(config) # map-scollector alias inNet-to-bypass
(config map-scollector alias inNet-to-bypass) # from inNet
(config map-scollector alias inNet-to-bypass) # collector bypass
(config map-scollector alias inNet-to-bypass) # exit
(config) #

8. Configure the path of the traffic to inline tool.

(config) # inline-network alias inNet traffic-path to-inline-tool

9. Display the configuration for this example.

(config) # show inline-tool-group
(config) # show map

Example 15 expands on Example 14 by combining out-of-band (OOB) maps with a map passall originating from an inline network group on GigaVUE-HC2.

When the source port of an OOB map is associated with an inline network group, only one port is supported in the port list. In this case, multiple OOB maps are needed because each OOB map only accepts one inline network port as the input (the from argument of the map command).

A protected inline network (which uses bypass combo modules) is included in Example 15. You do not need to configure inline network ports or the inline networks because they are created automatically. The port pairs in Example 15 are
1/1/x17 and 1/1/x18, as well as 1/1/x19 and 1/1/x20. The aliases of the default inline networks in Example 15 are default_inline_net_1_1_1 and default_inline_net_1_1_2.

In Example 15, two OOB maps send traffic from each inline network port (associated with default_inline_net_1_1_1) to the OOB tool. Two more maps would be needed to send traffic from each inline network port (associated with default_inline_net_1_1_2) to the OOB tool, but this is not included in Example 15.

On GigaVUE-HC3, protected inline bypass can be configured on the bypass combo module on ports c1..c4.

On GigaVUE-HC1, protected inline bypass can be configured on the bypass combo module, or on the TAP-HC1-G10040 module placed in either bay 2 or bay 3, so the ports will be 1/2/g1..g8 or 1/3/g1..g8. On the TAP module, you will need to configure inline network ports and the inline network because they are not created automatically (as they are on bypass combo modules).

Step

Description

Command

1. Configure an inline network group consisting of two protected inline networks.

(config) # inline-network-group alias inNetGroup
(config inline-network-group alias inNetGroup) # network-list default_inline_net_1_1_1,default_inline_net_1_1_2
(config inline-network-group alias inNetGroup) # exit
(config) #

2. Configure a regular tool port of port type (tool) and administratively enable it. This is the OOB tool.

(config) # port 1/1/x12 type tool
(config) # port 1/1/x12 params admin enable

3. Configure two inline tool ports of port type (inline-tool) and administratively enable them.

(config) # port 1/2/x23 type inline-tool
(config) # port 1/2/x23 params admin enable

(config) # port 1/2/x24 type inline-tool
(config) # port 1/2/x24 params admin enable

4. Configure inline tool and enable it. Also, specify that the inline tool is going to be shared by different sources. When shared is enabled (true), the inline tool can receive traffic from multiple sources (the inline networks in the inline network group).

(config) # inline-tool alias inTool1 pair tool-a 1/2/x23 and tool-b 1/2/x24
(config) # inline-tool alias inTool1 enable
(config) # inline-tool alias inTool1 shared true

5. Configure a map passall, from the inline network group to the inline tool. This sends all the traffic to the inline tool.

(config) # map-passall alias inline_map1
(config map-passall alias inline_map1) # from inNetGroup
(config map-passall alias inline_map1) # to inTool1
(config map-passall alias inline_map1) # exit
(config) #

6. Configure the first rule-based map. This is an OOB map from one inline network port (associated with default_inline_net_1_1_1) to the OOB tool.

(config) # map alias OoB_map1
(config map alias OoB_map1) # type regular byRule
(config map alias OoB_map1) # rule add pass ipver 4
(config map alias OoB_map1) # to 1/1/x12
(config map alias OoB_map1) # from 1/1/x17
(config map alias OoB_map1) # exit
(config) #

7. Configure a second rule-based map. This is an OOB map from the other inline network port (associated with default_inline_net_1_1_1) to the OOB tool.

(config) # map alias OoB_map2
(config map alias OoB_map2) # type regular byRule
(config map alias OoB_map2) # rule add pass ipver 4
(config map alias OoB_map2) # to 1/1/x12
(config map alias OoB_map2) # from 1/1/x18
(config map alias OoB_map2) # exit
(config) #

8. Configure a third rule-based map. This is an OOB map from a single inline tool port to the OOB tool.

(config) # map alias OoB_map3
(config map alias OoB_map3) # type inline byRule
(config map alias OoB_map3) # rule add pass ipver 4
(config map alias OoB_map3) # to 1/1/x12
(config map alias OoB_map3) # from 1/2/x23
(config map alias OoB_map3) # exit
(config) #

9. Configure the path of the traffic to inline tool.

(config) # inline-network alias default_inline_net_1_1_1 traffic-path to-inline-tool
(config) # inline-network alias default_inline_net_1_1_2 traffic-path to-inline-tool

10. Disable physical bypass on the default inline network aliases.

(config) # inline-network alias default_inline_net_1_1_1 physical-bypass disable
(config) # inline-network alias default_inline_net_1_1_2 physical-bypass disable

11. Display the configuration and statistics for this example.

(config) # show inline-network
(config) # show inline-network-group
(config) # show inline-tool
(config) # show map

Example 9 is an inline bypass solution on GigaVUE-HC2 for an inline network group. Example 9 expands upon Example 8 by adding a second inline tool. The inline networks are a mix of unprotected and protected.

In addition, user-defined VLAN tags are added in Example 9 to guide traffic from the multiple inline networks in the inline network group.

On GigaVUE-HC3, unprotected inline bypass can be configured on any module on the node. Protected inline bypass can be configured on the bypass combo module on ports c1..c4.

On GigaVUE-HC1, unprotected inline bypass can be configured on the base module, with the inline networks and inline tools on ports 1/1/x1..x12 and 1/1/g1..g4, or on the bypass combo module on ports x1..x4. Protected inline bypass can be configured on the bypass combo module, or on the TAP-HC1-G10040 module placed in either bay 2 or bay 3, so the ports will be 1/2/g1..g8 or 1/3/g1..g8. On the TAP module, you will need to configure inline network ports and the inline network because they are not created automatically (as they are on bypass combo modules).

Step

Description

Command

1. Configure inline network aliases, port type (inline-network), and administratively enable inline network ports.

(config) # port 7/2/x1 alias iN1
(config) # port iN1 type inline-network
(config) # port iN1 params admin enable

(config) # port 7/2/x20 alias iN2
(config) # port iN2 type inline-network
(config) # port iN2 params admin enable

2. Configure inline network.

(config) # inline-network alias inNet pair net-a iN1 and net-b iN2

3. Configure an inline network group consisting of a single unprotected inline network and two protected inline networks.

(config) # inline-network-group alias inNetGroup
(config inline-network-group alias inNetGroup) # network-list inNet,default_inline_net_7_2_1,default_inline_net_7_2_3
(config inline-network-group alias inNetGroup) # exit
(config) #

4. (Optional) Configure user-defined VLAN tags.

Note: The net-a and net-b ports can have the same VLAN tag, but tags must otherwise be unique within the inline network group.

(config) # port 7/2/x1 ingress-vlan-tag 1201
(config) # port 7/2/x20 ingress-vlan-tag 1202
(config) # port 7/2/x17 ingress-vlan-tag 1203
(config) # port 7/2/x18 ingress-vlan-tag 1203

5. Configure inline tool ports, port type (inline-tool), and administratively enable inline tool ports.

(config) # port 7/2/x3 alias iT1
(config) # port iT1 type inline-tool
(config) # port iT1 params admin enable

(config) # port 7/2/x4 alias iT2
(config) # port iT2 type inline-tool
(config) # port iT2 params admin enable

(config) # port 7/2/x9 alias iT3
(config) # port iT3 type inline-tool
(config) # port iT3 params admin enable

(config) # port 7/2/x10 alias iT4
(config) # port iT4 type inline-tool
(config) # port iT4 params admin enable

6. Configure inline tools and enable them. Also, specify that inline tools are going to be shared by different sources. When shared is enabled (true), the inline tools can receive traffic from multiple sources (the inline networks in the inline network group).

(config) # inline-tool alias inTool1 pair tool-a iT1 and tool-b iT2
(config) # inline-tool alias inTool2 pair tool-a iT3 and tool-b iT4

(config) # inline-tool alias inTool1 enable
(config) # inline-tool alias inTool2 enable

(config) # inline-tool alias inTool1 shared true
(config) # inline-tool alias inTool2 shared true

7. Configure inline tool group and enable it.

(config) # inline-tool-group alias inToolGroup tool-list inTool1,inTool2
(config) # inline-tool-group alias inToolGroup enable

8. Configure map passall, from inline network to inline tool group.

(config) # map-passall alias inMap
(config map-passall alias inMap) # from inNet
(config map-passall alias inMap) # to inToolGroup
(config map-passall alias inMap) # exit
(config) #

9. Configure the path of the traffic to inline tool.

(config) # inline-network alias inNet traffic-path to-inline-tool
(config) # inline-network alias default_inline_net_7_2_1 traffic-path to-inline-tool
(config) # inline-network alias default_inline_net_7_2_3 traffic-path to-inline-tool

10. Disable physical bypass on the default inline network aliases.

(config) # inline-network alias default_inline_net_7_2_1 physical-bypass disable
(config) # inline-network alias default_inline_net_7_2_3 physical-bypass disable

11. Display the configuration for this example.

(config) # show inline-network-group
(config) # show ingress-vlan-tag
(config) # show inline-tool-group

Example 8 is an inline bypass solution on GigaVUE-HC2 for an inline network group. This is a many-to-one example with two inline networks and one inline tool. The inline networks are mix of protected and unprotected.

On GigaVUE-HC3, unprotected inline bypass can be configured on any module on the node. Protected inline bypass can be configured on the bypass combo module on ports c1..c4.

On GigaVUE-HC1, unprotected inline bypass can be configured on the base module, with the inline networks and inline tools on ports 1/1/x1..x12 and 1/1/g1..g4, or on the bypass combo module on ports x1..x4. Protected inline bypass can be configured on the bypass combo module, or on the TAP-HC1-G10040 module placed in either bay 2 or bay 3, so the ports will be 1/2/g1..g8 or 1/3/g1..g8. On the TAP module, you will need to configure inline network ports and the inline network because they are not created automatically (as they are on bypass combo modules).

Step

Description

Command

1. Configure inline network aliases, port type (inline-network), and administratively enable inline network ports.

(config) # port 7/2/x1 alias iN1
(config) # port iN1 type inline-network
(config) # port iN1 params admin enable

(config) # port 7/2/x20 alias iN2
(config) # port iN2 type inline-network
(config) # port iN2 params admin enable

2. Configure inline network.

(config) # inline-network alias inNet pair net-a iN1 and net-b iN2

3. Configure an inline network group consisting of a single unprotected inline network and two protected inline networks.

(config) # inline-network-group alias inNetGroup
(config inline-network-group alias inNetGroup) # network-list inNet,default_inline_net_7_2_1,default_inline_net_7_2_3
(config inline-network-group alias inNetGroup) # exit
(config) #

4. Configure inline tool ports, port type (inline-tool), and administratively enable inline tool ports.

(config) # port 7/2/x3 alias iT1
(config) # port iT1 type inline-tool
(config) # port iT1 params admin enable

(config) # port 7/2/x4 alias iT2
(config) # port iT2 type inline-tool
(config) # port iT2 params admin enable

5. Configure inline tool and enable it. Also, specify that the inline tool is going to be shared by different sources. When shared is enabled (true), the inline tool can receive traffic from multiple sources (the inline networks in the inline network group).

(config) # inline-tool alias inTool pair tool-a iT1 and tool-b iT2
(config) # inline-tool alias inTool enable
(config) # inline-tool alias inTool shared true

6. Configure map passall, from inline network group to inline tool.

(config) # map-passall alias inMap
(config map-passall alias inMap) # from inNetGroup
(config map-passall alias inMap) # to inTool
(config map-passall alias inMap) # exit
(config) #

7. Configure the path of the traffic to inline tool.

(config) # inline-network alias inNet traffic-path to-inline-tool
(config) # inline-network alias default_inline_net_7_2_1 traffic-path to-inline-tool
(config) # inline-network alias default_inline_net_7_2_3 traffic-path to-inline-tool

8. Disable physical bypass on the default inline network aliases.

(config) # inline-network alias default_inline_net_7_2_1 physical-bypass disable
(config) # inline-network alias default_inline_net_7_2_3 physical-bypass disable

9. Display the configuration for this example.

(config) # show inline-network-group
(config) # show inline-tool
(config) # show map

Example 5 is an inline bypass solution on GigaVUE-HC2 for an inline tool group with N+1 redundancy. In this example, N=2. The inline network is unprotected. Example 5 expands upon Example 3 by adding a spare to the inline tool group.

Step

Description

Command

1. Configure inline network aliases, port type (inline-network), and administratively enable inline network ports.

(config) # port 3/1/x1 alias iN1
(config) # port iN1 type inline-network
(config) # port iN1 params admin enable

(config) # port 3/1/x2 alias iN2
(config) # port iN2 type inline-network
(config) # port iN2 params admin enable

2. Configure inline network.

(config) # inline-network alias inNet pair net-a iN1 and net-b iN2

3. Configure inline tool ports, port type (inline-tool), and administratively enable inline tool ports.

(config) # port 3/1/x3 alias iT1
(config) # port iT1 type inline-tool
(config) # port iT1 params admin enable

(config) # port 3/1/x4 alias iT2
(config) # port iT2 type inline-tool
(config) # port iT2 params admin enable

(config) # port 3/1/x5 alias iT3
(config) # port iT3 type inline-tool
(config) # port iT3 params admin enable

(config) # port 3/1/x6 alias iT4
(config) # port iT4 type inline-tool
(config) # port iT4 params admin enable

(config) # port 3/1/x7 alias iT5
(config) # port iT5 type inline-tool
(config) # port iT5 params admin enable

(config) # port 3/1/x8 alias iT6
(config) # port iT6 type inline-tool
(config) # port iT6 params admin enable

4. Configure inline tools and enable them.

(config) # inline-tool alias inTool1 pair tool-a iT1 and tool-b iT2
(config) # inline-tool alias inTool2 pair tool-a iT3 and tool-b iT4
(config) # inline-tool alias inTool3 pair tool-a iT5 and tool-b iT6

(config) # inline-tool alias inTool1 enable
(config) # inline-tool alias inTool2 enable
(config) # inline-tool alias inTool3 enable

5. Configure inline tool group and parameters. Enable it and then configure failover action.

(config) # inline-tool-group alias inToolGroup
(config inline-tool-group alias inToolGroup) # tool-list inTool1,inTool2
(config inline-tool-group alias inToolGroup) # spare-inline-tool inTool3
(config inline-tool-group alias inToolGroup) # release-spare-if-possible
(config inline-tool-group alias inToolGroup) # hash advanced
(config inline-tool-group alias inToolGroup) # minimum-group-healthy-size 2
(config inline-tool-group alias inToolGroup) # enable
(config inline-tool-group alias inToolGroup) # failover-action tool-bypass
(config inline-tool-group alias inToolGroup) # exit
(config) #

6. Configure map passall, from inline network to inline tool group.

(config) # map-passall alias inMap
(config map-passall alias inMap) # from inNet
(config map-passall alias inMap) # to inToolGroup
(config map-passall alias inMap) # exit
(config) #

7. Configure the path of the traffic to inline tool.

(config) # inline-network alias inNet traffic-path to-inline-tool

8. Display the configuration for this example.

(config) # show inline-tool-group

Example 3 adds a second inline tool to the unprotected inline bypass solution on GigaVUE-HC2 in Example 1 and creates an inline tool group consisting of two tools. It also configures a custom heartbeat profile.

Step

Description

Command

1. Configure inline network aliases, port type (inline-network), and administratively enable inline network ports.

(config) # port 3/1/x1 alias iN1
(config) # port iN1 type inline-network
(config) # port iN1 params admin enable

(config) # port 3/1/x2 alias iN2
(config) # port iN2 type inline-network
(config) # port iN2 params admin enable

2. Configure inline network.

(config) # inline-network alias inNet pair net-a iN1 and net-b iN2

3. Configure inline tool ports, port type (inline-tool), and administratively enable inline tool ports.

(config) # port 3/1/x3 alias iT1
(config) # port iT1 type inline-tool
(config) # port iT1 params admin enable

(config) # port 3/1/x4 alias iT2
(config) # port iT2 type inline-tool
(config) # port iT2 params admin enable

(config) # port 3/1/x5 alias iT3
(config) # port iT3 type inline-tool
(config) # port iT3 params admin enable

(config) # port 3/1/x6 alias iT4
(config) # port iT4 type inline-tool
(config) # port iT4 params admin enable

4. Configure a custom heartbeat profile.

(config) # hb-profile alias hb_custom
(config hb-profile alias hb_custom) # custom-packet http://1.1.1.1/tftpboot/hbpackets/MyHBPacket.pcap
(config hb-profile alias hb_custom) # packet-format custom
(config hb-profile alias hb_custom) # exit
(config) #

5. Configure inline tools and enable them.

(config) # inline-tool alias inTool1 pair tool-a iT1 and tool-b iT2
(config) # inline-tool alias inTool2 pair tool-a iT3 and tool-b iT4

(config) # inline-tool alias inTool1 enable
(config) # inline-tool alias inTool2 enable

6. Specify heartbeat profile and enable heartbeat on each inline tool.

(config) # inline-tool alias inTool1 hb-profile hb_custom
(config) # inline-tool alias inTool2 hb-profile hb_custom
(config) # inline-tool alias inTool1 heart-beat
(config) # inline-tool alias inTool2 heart-beat

7. Configure inline tool group and enable it.

(config) # inline-tool-group alias inToolGroup tool-list inTool1,inTool2
(config) # inline-tool-group alias inToolGroup enable

8. Configure map passall, from inline network to inline tool group.

(config) # map-passall alias inMap
(config map-passall alias inMap) # from inNet
(config map-passall alias inMap) # to inToolGroup
(config map-passall alias inMap) # exit
(config) #

9. Configure the path of the traffic to inline tool.

(config) # inline-network alias inNet traffic-path to-inline-tool

10. Display the configuration for this example.

(config) # show inline-tool-group
(config) # show hb-profile
(config) # show map

Example 5—Unprotected Flexible Inline, Inline Tool Group

Example 5 adds an inline tool group to Example 4. It has the same two inline networks and five inline tools, but now the third, fourth, and fifth tools (t1112, t1314, and t1516) are in an inline tool group. The maps have been modified to direct traffic to the inline tool group.

For example, the inline tools can be Web Application Firewall (WAF), Intrusion Prevention System (IPS), while the Advanced Persistent Threat (APT) is the inline tool group.

The inline tool aliases are t0708 to t1516, based on ports x7 to x16. The inline tool group alias is ITG1.

Use the following steps to configure Example 5:

 

Step

Description

Command

1.    
Configure inline network ports, port type (inline-network), and administratively enable inline network ports.

(config) # port 1/3/x1..x4 type inline-network
(config) # port 1/3/x1..x4 params admin enable

2.  
Configure inline networks.

(config) # inline-network alias n0102 pair net-a 1/3/x1 and net-b 1/3/x2

(config) # inline-network alias n0304 pair net-a 1/3/x3 and net-b 1/3/x4

3.  
Configure inline tool ports, port type (inline-tool), and administratively enable inline tool ports.

(config) # port 1/3/x7..x16 type inline-tool
(config) # port 1/3/x7..x16 params admin enable

4.  
Configure inline tools, specify that the inline tool is going to be shared by different sources, and enable them.

(config) # inline-tool alias t0708 pair tool-a 1/3/x7 and tool-b 1/3/x8
(config) # inline-tool alias t0708 shared true
(config) # inline-tool alias t0708 enable

(config) # inline-tool alias t0910 pair tool-a 1/3/x9 and tool-b 1/3/x10
(config) # inline-tool alias t0910 shared true
(config) # inline-tool alias t0910 enable

(config) # inline-tool alias t1112 pair tool-a 1/3/x11 and tool-b 1/3/x12
(config) # inline-tool alias t1112 shared true
(config) # inline-tool alias t1112 enable

(config) # inline-tool alias t1314 pair tool-a 1/3/x13 and tool-b 1/3/x14
(config) # inline-tool alias t1314 shared true
(config) # inline-tool alias t1314 enable

(config) # inline-tool alias t1516 pair tool-a 1/3/x15 and tool-b 1/3/x16
(config) # inline-tool alias t1516 shared true
(config) # inline-tool alias t1516 enable

5.  
Configure inline tool group and parameters. Enable it and then configure failover action.

(config) # inline-tool-group alias ITG1
(config inline-tool-group alias ITG1) # tool-list t1112,t1314,t1516
(config inline-tool-group alias ITG1) # hash advanced
(config inline-tool-group alias ITG1) # enable
(config inline-tool-group alias ITG1) # failover-action tool-bypass
(config inline-tool-group alias ITG1) # exit

6.  
Configure maps from inline networks to inline tools in both directions, add user-defined tags, and enable maps.

For the rule-based map, configure a rule (one rule only) to direct traffic to the tools. The rule can be based on any map rule criteria such as TCP port, IP subnet, or VLAN.

Note: The tag is optional. The default is auto, which automatically assigns tags.

(config) # map alias FLEX1
(config map alias FLEX1) # type flexInline collector
(config map alias FLEX1) # from n0102
(config map alias FLEX1) # a-to-b t0708,t0910,ITG1
(config map alias FLEX1) # b-to-a reverse
(config map alias FLEX1) # tag 100
(config map alias FLEX1) # enable
(config map alias FLEX1) # exit
(config) #

(config) # map alias FLEX2
(config map alias FLEX2) # type flexInline collector
(config map alias FLEX2) # from n0304
(config map alias FLEX2) # a-to-b t0708,ITG1
(config map alias FLEX2) # b-to-a reverse
(config map alias FLEX2) # tag 200
(config map alias FLEX2) # enable
(config map alias FLEX2) # exit
(config) #

(config) # map alias FLEX3
(config map alias FLEX3) # type flexInline byRule
(config map alias FLEX3) # from n0102
(config map alias FLEX3) # a-to-b ITG1
(config map alias FLEX3) # b-to-a reverse
(config map alias FLEX3) # rule add pass ipver 4
(config map alias FLEX3) # tag 300
(config map alias FLEX3) # enable
(config map alias FLEX3) # exit
(config) #

7.  
Configure the path of the traffic to inline tools.

(config) # inline-network alias n0102 traffic-path to-inline-tool

(config) # inline-network alias n0304 traffic-path to-inline-tool