R3721-F3210-F3171-HP High-End Firewalls Network Management Configuration Guide-6PW101

532
Ste
p
Command Remarks
8. Set next hops.
apply ip-address next-hop
ip-address [ direct ] [ track
track-entry-number ] [ ip-address
[ direct ] [ track
track-entry-number ] ]
Optional.
Two next hops at most can be
specified. These two next hops are
simultaneously active to achieve
load sharing.
9. Set default outgoing
interfaces.
apply default output-interface
interface-type interface-number
[ track track-entry-number ]
[ interface-type interface-number
[ track track-entry-number ] ]
Optional.
Two default outgoing interfaces at
most can be specified. These two
interfaces are simultaneously
active to achieve load sharing.
10. Set default next hops.
apply ip-address default next-hop
ip-address [ track
track-entry-number ] [ ip-address
[ track track-entry-number ] ]
Optional.
Two default next hops at most can
be specified. These two next hops
are simultaneously active to
achieve load sharing.
NOTE:
• If an ACL match criterion is defined and the action of the specified ACL is permit, packets are matched
against the ACL rules. If the specified ACL does not exist or the action of the specified ACL is deny, no
packet is matched.
• If an ACL match criterion is defined, packets are matched against the ACL rules, whereas the permit or
deny action of the specified ACL is ignored. If the specified ACL does not exist, no packet is matched.
• You can configure two next hops by using the apply ip-address next-hop command twice (first case) or
once (second case). After that, executing the apply ip-address next-hop command with a new next hop
will replace the earlier confi
g
ured next hop in the first case, or will replace the second next hop specified
in the second case. To remove both next hops, execute the apply ip-address next-hop command a
g
ain
by specifying two next hops. The apply output-interface, apply default output-interface, and apply
ip-address default next-hop work the in same way.
• For a point to point (P2P) link, the next hop address is the peer address, so you need to specify only the
outgoing interface using the apply output-interface
interface-type interface-number [ track
track-entry-number ] [ interface-type interface-number [ track track-entry-number ] ] command. For a
non-P2P link, you need to specify the next hop address besides the outgoing interface.
CAUTION:
• If a policy node has no if-match clause confi
g
ured, all packets can match the policy node. However, an
action is taken accordin
g
to the match mode, and the packets will not
g
o to the next policy node for a
match.
• If a permit-mode policy node has no apply clause configured, packets matching all the if-match clauses
of the node can pass the policy node, and no action is taken. The matchin
g
packets will not
g
o to the
next policy node for a match, and will be forwarded according to the routing table.
• If a policy node has neither if-match nor apply clauses configured, all packets can match the policy
node. However, no action is taken. The packets will not
g
o to the next policy node for a match, and will
be forwarded according to the routing table.