topic Re: CSS 11503 Bypassing Content Rules in Application Networking

CSS 11503 Bypassing Content Rules

alanwright1 — Thu, 11 Jan 2007 12:46:00 GMT

Hi,

I am trying to decipher how to bypass the content rules being processed to allow the traffic to go direct to the real (origin) server without going via a loadbalanced device. As I know the destination IP's it seems to me that I can use ACL's with the bypass keyword, to bypass the rule engine. If this is true, then I have a couple of questions regarding ACL's in CSS.

1. CSS ACL's seem to support 255 clauses, can they support more entries say 500?

2. If the answer to Q1 is no, then can I apply more than one ACL to a circuit?

Alan

Re: CSS 11503 Bypassing Content Rules

Gilles Dufour — Thu, 11 Jan 2007 12:56:07 GMT

Alan,

it's more simple than that.

If you want to access the real server directly use its ip address instead of the virtual ip.

The CSS is also a router/switch so it will route traffic that does not match a virtual ip.

No need for acl [except maybe to permit the traffic if you had it denied].

Gilles.

Re: CSS 11503 Bypassing Content Rules

alanwright1 — Thu, 11 Jan 2007 13:15:42 GMT

Thanks Gilles,

Can CSS support the setup of 500 VIPs?

Alan

Re: CSS 11503 Bypassing Content Rules

Gilles Dufour — Thu, 11 Jan 2007 14:56:17 GMT

Alan,

yes, you can have 500 vips on a CSS.

Gilles.

Re: CSS 11503 Bypassing Content Rules

alanwright1 — Thu, 11 Jan 2007 16:44:01 GMT

Hi Gilles,

Thanks again for the feedback.

As I have no IP for the content defined, it'll try to match any IP. So I see two options now, given that I need to filter out approx 500 ip's from the "catch all" content rule.

1. Bypass using ACL and NQL have a single NQL with 500 IP host entries. Linking this to a single clause in the ACL assigned to the incoming interface.

2. Add 500 contents rules with each vip assigned into one content rule.

Would you agree that the better approach would be to use option 1 as it would contain less config?

Alan

Re: CSS 11503 Bypassing Content Rules

Gilles Dufour — Fri, 12 Jan 2007 07:44:50 GMT

Alan,

ok, I see the need for the bypass now.

I think that option 1 is much better.

Gilles.