Virtual routing, Overview, A simple scenario – Amer Networks E5Web GUI User Manual
Page 288: Section 4.5, “virtual routing
4.5. Virtual Routing
4.5.1. Overview
Virtual Routing is a cOS Core feature that allows the creation of multiple, logically separated
virtual systems within cOS Core, each with its own routing table. These systems can behave as
physically separated Clavister Security Gateways and almost everything that can be done with
separate gateways can be done with them, including dynamic routing with OSPF. Virtual systems
are sometimes also referred to as Virtual Routers.
The cOS Core components involved in creating virtual routing are:
•
Separate routing tables for each virtual system.
•
Per-interface policy-based routing table membership to make interface IP addresses
reachable only via a particular routing table. This association can be made explicitly by
linking an interface with a specific routing table.
•
Pairs of loopback interfaces can be used for communication between virtual systems if
required.
There are two ways of associating a specific routing table with a specific interface:
•
Using Routing Rules
Routing Rules can be defined so that all traffic on a particular interface are subject to a
particular routing table.
•
Specifying a Routing Table for an Interface
It is possible to associate an interface directly with a specific routing table. This is known as
the interface's routing table membership. This option is part an interface's virtual routing
options.
This is the preferred way of implementing a virtual router. The interface might be physical or
it could be a virtual LAN (VLAN).
To ensure that a routing table does not use any other tables in the route lookup process, the
Ordering parameter of the table should be set to Only.
4.5.2. A Simple Scenario
Consider a single Clavister Security Gateway connected to two external ISPs, ISP1 and ISP2. ISP1
provides Internet connection to the internal network for Department A and connects to the
Clavister Security Gateway via the physical interface If1.
ISP2 provides Internet connection to the internal network for Department B and connects via the
physical interface If2. For administration purposes it is decided that the Clavister Security
Gateway is to be divided into 2 virtual systems, one for each ISP.
This is done by creating two dedicated routing tables. pbr1 is created to handle traffic for ISP1
and Department A. pbr2 is created to handle traffic for ISP2 and Department B. This arrangement is
illustrated in the diagram below.
Chapter 4: Routing
288