User's Manual

Configuring GRE, NAT, RIPSO, and BFE Services
3-16
308625-14.00 Rev 00
RIPSO Example
The router in Figure 3-2 has RIPSO configured on all three IP interfaces. The
security ranges specified for each interface vary, as shown. (For simplicity, this
example assumes that none of the interfaces requires any authority flags on
inbound and outbound traffic, but any flags that are present are acceptable.)
When host 1.1.0.1 broadcasts an all-subnets broadcast IP datagram with the
security-level classification set to Secret, the router compares the datagram’s
classification with the range configured on inbound interface 1.1.0.2. Because the
Secret security level is within the range configured on the interface, the router
accepts the datagram. In order to forward the datagram, the router does the
following:
• Compares the datagram’s security level, Secret, to the security-level ranges
configured on interfaces 1.2.0.2 and 1.3.0.2
• Forwards the datagram on interface 1.2.0.2, because Secret is within the
security range configured on the interface
•Does not forward the datagram on interface 1.3.0.2, because Secret is outside
the security range configured on the interface