R3721-F3210-F3171-HP High-End Firewalls Network Management Configuration Guide-6PW101

522
{ permit—Specifies the match mode of a policy node as permit. If a packet satisfies all the
if-match clauses on the policy node, the apply clause is executed. If not, the packet will go to
the next policy node.
{ deny—Specifies the match mode of a policy node as deny. When a packet satisfies all the
if-match clauses on the policy node, the packet will be rejected and will not go to the next
policy node.
A packet satisfying the match criteria on a node will not go to other nodes. If the packet does not
satisfy the match criteria of any node of the policy, the packet cannot pass the policy and will be
forwarded through the routing table.
PBR classification
PBR falls into the following types:
• Local PBR—Applies to locally generated packets only.
• Interface PBR—Applies to packets forwarded through the interface only.
To meet general forwarding and security requirements, interface PBR is used in most cases.
PBR and track
Associated with a track object, PBR can sense topology changes faster. You can associate PBR with a
track entry when you configure the outgoing interface, default outgoing interface, next hop, and default
next hop to dynamically determine link reachability. The PBR configuration takes effect when the status of
the associated track object is Positive or Invalid.
NOTE:
For more information about track-PBR collaboration, see
High Availability Configuration Guide.
Configuring PBR in the web interface
Configuration task list
Task Remarks
Configuring a policy
and the policy node
Required.
Create a policy and configure the policy node.
By default, no policy is created.
Applying a policy
Enabling
local PBR
Optional.
Only one policy can be referenced when local PBR is enabled.
Local PBR is not configured by default.
IMPORTANT:
Unless otherwise required, HP does not recommend enabling local PBR.
Enabling
interface
PBR
Required.
Only one policy can be referenced when PBR is enabled on an
interface.
Interface PBR is not configured by default.